ConverterHub

HMAC Generator

Create a keyed-hash message authentication code from text and a key.

Result

7b77ae021175ae405bff9d1e83b136dde61744ff

How it is calculated

HMAC mixes a secret key into a hash so that only someone who knows the key can produce or check the value: HMAC(K, m) = H((K ⊕ opad) ‖ H((K ⊕ ipad) ‖ m)), where H is the chosen hash, m the message text and K the key. The tool supports SHA-256 (the default), SHA-1, MD5 and SHA-512, and any other value falls back to SHA-256. Both the text and the key must be filled in. The output is lowercase hexadecimal: 64 characters for SHA-256, 128 for SHA-512, 40 for SHA-1 and 32 for MD5. The same text, key and algorithm always give the same value, and even a one-character change gives a completely different one.

Worked example

The message is order=1042&amount=59.90, the key is s3cret-key and the algorithm is SHA-1. The tool applies the HMAC construction to the text bytes and returns 40 hex characters: 7b77ae021175ae405bff9d1e83b136dde61744ff. A server that holds the same key recomputes this value from the received message and compares it with the one sent; if one character of the message changes, the values no longer match.

Try this example →

Common mistakes

  • Adding a trailing space or line break to the text or key. It is part of the input, so the result changes completely.
  • Comparing HMACs produced with different algorithms. SHA-1 and SHA-256 outputs for the same input will never match.
  • Treating HMAC as encryption. The message is not hidden and cannot be recovered from the value; it only proves integrity and knowledge of the key.
  • Using a short or guessable key. Security rests on the key, so a weak key can be found by guessing.
  • Pasting a real production secret into any online tool; use a test key.

About this calculator

This tool generates an HMAC (Hash-based Message Authentication Code) — a cryptographic construction that combines a secret key with a hash function (SHA256, SHA1, MD5, or SHA512) to verify both the integrity and authenticity of a message. Unlike a plain hash, an HMAC can't be reproduced without knowing the secret key, so it proves the message wasn't tampered with and came from someone who holds that key.

Developers use HMACs to sign API requests (many REST APIs authenticate calls this way), verify webhook payloads, protect JWTs, and secure session tokens. Enter your text and secret key and choose a hash algorithm — SHA256 is the current standard for most security-sensitive uses, since MD5 and SHA1 are considered cryptographically weak.

Was this helpful?

You can pick up to 3 reactions.

Comments (0)

  • Be the first to comment.

Popular calculators

Loan Calculator

Monthly payment, total interest and full amortization schedule.

Percentage Calculator

Percent change, percent of, and ratio calculations.

Discount Calculator

Calculate final price, savings, and discount amount.

BMI Calculator

Body mass index from height and weight (metric or imperial).

Age Calculator

Compute your exact age in years, months and days from a birth date.

Compound Interest Calculator

Calculate the final amount and interest earned with compounding.

All Calculators