Encoders / Cryptography

HMAC Generator / Tester

Compute a Hash-based Message Authentication Code (HMAC) using a secret key and MD5, SHA-1, SHA-256, SHA-512, RIPEMD or Whirlpool.

Copy-paste the string here

Secret key

Key format

Algorithm

Algorithms marked "(server)" are computed by api/hash.php in memory; everything else runs in your browser.

Output format

Verify against expected HMAC (optional)

Ctrl + Enter

HMAC Explained

What is an HMAC?

An HMAC (Hash-based Message Authentication Code, RFC 2104, FIPS 198-1) is a short tag computed from a message and a secret key using a cryptographic hash function. Anyone who knows the key can recompute the tag and check that it matches; anyone who does not know the key cannot produce a valid tag for a new or modified message, even after seeing millions of valid message/tag pairs. A plain hash such as SHA-256 only proves that data was not accidentally altered — an attacker can simply recompute it. The key is what turns a hash into an authentication mechanism.

The construction is deliberately simple so that it can be built on top of any hash function H with block size B (64 bytes for MD5, SHA-1 and SHA-256, 128 bytes for SHA-384/512):

HMAC(K, m) = H( (K' ⊕ opad) ∥ H( (K' ⊕ ipad) ∥ m ) )

K'   = K padded with zeros to B bytes (K is first hashed if it is longer than B)
ipad = the byte 0x36 repeated B times
opad = the byte 0x5C repeated B times
⊕    = XOR,  ∥ = concatenation

The message is hashed twice: an inner hash mixes the key with the message, an outer hash mixes the key with the inner result. This nested structure is what protects HMAC against the length-extension weakness of the naive H(key ∥ message), and it keeps HMAC secure even with hash functions whose collision resistance is broken (HMAC-MD5 and HMAC-SHA-1 are still not practically forgeable, although new designs should avoid them).

What does it protect?

Integrity: any change to the message, even a single bit, changes the tag.
Authenticity: only holders of the secret key can produce a valid tag, so a valid tag proves the message comes from a trusted party.
It does not provide confidentiality (the message is not encrypted) nor non-repudiation (every key holder can produce the same tag; use digital signatures for that).

Choosing a key

Use a random key, at least as long as the hash output: 32 bytes (256 bits) for HMAC-SHA-256, 64 bytes for HMAC-SHA-512. Longer keys do not add security beyond the block size; shorter keys reduce it.
Human-readable passwords make poor keys. If you must derive a key from a password, run it through PBKDF2, scrypt or Argon2 first.
Keys are bytes, not text. This tool accepts them as plain text (UTF-8), hexadecimal or Base64 so you can paste keys exactly as your application stores them.
Compare tags with a constant-time comparison (hash_equals() in PHP, crypto.timingSafeEqual() in Node, hmac.compare_digest() in Python) to avoid timing attacks.

Typical uses

Use	How HMAC is applied
API request signing	AWS Signature v4, Azure Shared Key and many payment APIs compute HMAC-SHA-256 over the canonical request with the account secret; the server recomputes it to authenticate the caller.
JSON Web Tokens (HS256 / HS384 / HS512)	The signature is `HMAC-SHA-256(base64url(header) + "." + base64url(payload), secret)`.
Webhooks	GitHub (`X-Hub-Signature-256`), Stripe, Slack and Shopify sign webhook bodies with HMAC-SHA-256 so receivers can reject forged calls.
TLS, IPsec, SSH	HMAC authenticates every record of older cipher suites and derives keys (HKDF is built on HMAC).
One-time passwords	HOTP and TOTP (Google Authenticator) are HMAC-SHA-1 of a counter or a time step, truncated to 6 digits.
Cookies and session tokens	Frameworks sign cookies (`value.signature`) so users cannot tamper with them.

Supported hash functions

HMAC variant	Tag size	Recommendation
HMAC-SHA-256	256 bits	The default choice: fast, universally supported, secure.
HMAC-SHA-384 / SHA-512 / SHA-512/256	384 / 512 / 256 bits	Faster on 64-bit CPUs; used by JWT HS384/HS512 and TLS 1.2 suites.
HMAC-SHA3-224…512	224–512 bits	Secure; note that SHA-3 does not need HMAC against length extension (KMAC exists), but HMAC-SHA3 is standardized and fine.
HMAC-SHA-1	160 bits	Still safe as a MAC (HOTP/TOTP rely on it) but deprecated for new protocols.
HMAC-MD5	128 bits	Legacy (CRAM-MD5, old APIs). Not broken as a MAC, but avoid.
HMAC-SHA-224, RIPEMD-128/160/256/320, Whirlpool, Tiger, GOST, MD2, MD4	various	Provided for interoperability with legacy systems; MD2, MD4 and RIPEMD-128 are too short or too weak for new designs.

Privacy note: HMAC-MD5, HMAC-SHA-1 and the HMAC-SHA-2 family are computed in your browser (WebCrypto or pure JavaScript). Variants marked "(server)" in the list — SHA-3, MD2, MD4, RIPEMD, Whirlpool, Tiger, GOST — are not available in browsers and are computed by api/hash.php using PHP's hash_hmac(); the message and key are processed in memory and never stored. Do not paste production secrets into any online tool if that is not acceptable to you.

Result