HMAC Generator
Compute HMAC-SHA256, SHA-384, SHA-512, SHA-224, SHA-1, MD5, SHA3 or RIPEMD-160 of a message with a text, hex or Base64 key. Hex or Base64 output, live.
HMAC (RFC 2104) mixes the key into the hash twice: H((K ⊕ opad) || H((K ⊕ ipad) || message)). Keys longer than the hash block are hashed first. Compare MACs in constant time on the server.
What is HMAC Generator?
Calculates a keyed-hash message authentication code (HMAC, RFC 2104) for a message and a secret key. It supports SHA-2, SHA-3, SHA-1, MD5 and RIPEMD-160, keys given as text, hex or Base64, and shows the MAC in lowercase/uppercase hex or Base64 as you type.
How to use HMAC Generator
- Type the Message (text, or switch the encoding to Hex for raw bytes).
- Enter the Secret key and choose whether it is text (UTF-8), Hex or Base64.
- Pick the Algorithm, e.g. HMAC-SHA-256.
- Choose the Output format and copy the HMAC.
Example
Message "what do ya want for nothing?", key "Jefe", HMAC-SHA-256
5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843
RFC 4231 test case 2.
When to use HMAC Generator
Use it to verify webhook signatures (Stripe, GitHub, Shopify, Slack), sign API requests, debug AWS-style signing steps or check HMAC test vectors. It is not suitable for hashing passwords (use bcrypt or Argon2) and is not a digital signature: anyone with the key can create the MAC.
How HMAC Generator works
HMAC(K, m) = H((K′ ⊕ opad) ‖ H((K′ ⊕ ipad) ‖ m)), where K′ is the key padded with zeros to the hash block size (keys longer than the block are hashed first), ipad = 0x36 and opad = 0x5C repeated. This construction stays secure even for hashes like MD5 and SHA-1 whose collision resistance is broken. Digests come from hash-wasm, and the results match the RFC 4231 and RFC 2202 test vectors.
Common Use Cases
- Verify a GitHub
X-Hub-Signature-256or Stripe webhook signature - Reproduce an API request signature while debugging
- Check HMAC test vectors from RFC 4231
- Generate HMAC-SHA1 values for legacy OAuth 1.0 or TOTP debugging
- Compare outputs between two languages that disagree
Security Note
The key and message stay in your browser. Compare MACs on the server with a constant-time function to avoid timing attacks.
FAQs
Why does my HMAC not match the webhook header?
Check that you hash the raw request body byte for byte (no reformatted JSON), the exact secret (some providers give it Base64 or with a prefix such as whsec_), and the expected output encoding – GitHub uses hex, Shopify uses Base64.
Is HMAC-SHA1 or HMAC-MD5 still secure?
As MACs they have no practical break, because HMAC does not rely on collision resistance. They are considered legacy; use HMAC-SHA-256 or stronger for new systems.
Can the key be empty?
RFC 2104 allows it and the tool computes it, but an empty key provides no security.
Is HMAC the same as hashing key + message?
No. Simple hash(key + message) is vulnerable to length-extension attacks with SHA-2; HMAC's double hashing prevents that.