How to use the hmac generator
- Enter the message, and say whether it is text, hex bytes or Base64.
- Enter the secret key and say how it is written. Use a test key unless you are on a computer you trust.
- Choose the hash function: SHA-256 is the usual choice, with SHA-384 and SHA-512 for longer outputs.
- Copy the HMAC as hex or Base64, or paste a value you were given into the compare box to see if it matches.
Two published test values
With the key "key" and the message "The quick brown fox jumps over the lazy dog", HMAC-SHA-256 is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8. This is the widely quoted example value for HMAC-SHA-256.
RFC 4231 test case 2 uses the key "Jefe" and the message "what do ya want for nothing?". HMAC-SHA-256 is 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843, which is W9zBRr9gdU5qBCQmCJV1x1oAPwidJzmDnexYuWTsOEM= in Base64. The tool is checked against the RFC cases, including a key longer than the hash block size, an empty key and an empty message.
What an HMAC proves
An HMAC mixes a secret key into a hash so that only someone with the key can produce or check the result. It is used to sign webhooks and API requests, to protect cookies and tokens and to derive keys. If the HMAC you compute from the message and the shared key equals the one that arrived, the message was not changed and came from a holder of the key.
A plain hash does not do this, because anyone can compute it. And an HMAC is not encryption: the message stays readable. When you compare HMACs in your own code, compare them in constant time, not with an ordinary string comparison.
Using this page safely
The HMAC is computed in your browser using the built-in SHA functions, and neither the message nor the key is uploaded or stored. Even so, treat a real production secret with care on a shared or public computer, and prefer test keys. SHA-1 is included only to check old systems. For a plain hash, use the Hash Generator. Related tools: the Base64 Encoder and Decoder, the TOTP Code Generator and the CRC Calculator for error checking.
Assumptions and limits
- The HMAC follows RFC 2104. Keys longer than the hash block (64 bytes for SHA-1 and SHA-256, 128 for SHA-384 and SHA-512) are hashed first.
- Text is converted to UTF-8 bytes. Hex ignores spaces, colons, dashes and 0x prefixes. Base64 may be standard or URL safe.
- Messages and keys can each be up to 5,000,000 bytes.
- The page needs a browser that provides the Web Crypto API on a secure page.
Frequently asked questions
What is the difference between a hash and an HMAC?
A hash depends only on the message, so anyone can compute it. An HMAC also depends on a secret key, so only people who know the key can make or check it.
Which hash function should I pick?
Use the one the other side expects. SHA-256 is the common choice for webhooks and APIs. SHA-1 is kept for checking older systems only.
Can the key be empty?
Yes. The HMAC of an empty key is defined, and the page computes it. In practice an empty key gives no protection, so use a long random key.
Why do I get a different value from another tool?
Check how the key and message are interpreted. A hex key typed as text, a trailing newline in the message, or Base64 versus hex output are the usual causes.