md5hash.net

HMAC Generator

Create HMAC-SHA256, HMAC-SHA384 or HMAC-SHA512 from a message and an explicitly encoded secret key.

0 bytesUTF-8 · No trimming or newline normalization

Click Generate hash after editing. This mode does not calculate automatically.

Your key stays in this tab. Clear it when finished. An empty key is allowed but is not a secure secret.

Results

Enter a message and key, then click Generate hash. Empty values are supported for testing.

Processed in your browser. No upload.

Other hash & checksum tools

What this tool calculates

HMAC authenticates a message using a shared secret and a selected hash function. This tool defaults to HMAC-SHA256 and also supports SHA384 and SHA512. It is not the same as hashing the key and message concatenated together, and it does not encrypt or conceal the message.

Message text is encoded as UTF-8. The key has a separate encoding control: UTF-8 interprets visible characters as text, while Hex interprets pairs of hexadecimal digits as raw bytes. For example, the Hex key 4a656665 represents the same bytes as the UTF-8 key Jefe. Spaces, odd-length strings and non-hexadecimal characters are rejected in Hex mode.

The example uses public test data from RFC 4231, not a secret generated for your application. Empty keys are supported by the implementation but do not provide a useful secret. Keys remain in this tab's memory and are not included in exports. Clear the page when finished, and use an audited implementation in your own application for real protocol verification.

Worked example

HMAC-SHA256 · UTF-8 · Jefe · what do ya want for nothing?

5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843

How to calculate and compare

  1. Enter the text to authenticate in Message. Its UTF-8 bytes are used without removing spaces or changing line endings.
  2. Enter Secret key and select Key encoding. UTF-8 uses the key as text; Hex reads pairs of hexadecimal digits as bytes. Hex must have an even number of digits and no spaces.
  3. Select HMAC-SHA-256, HMAC-SHA-384 or HMAC-SHA-512, then click Generate hash. HMAC never recalculates automatically; after changing the message, key, encoding or algorithm, generate again.
  4. Compare the full result with a reference produced using the same message bytes, key bytes and HMAC algorithm. SHA-256, SHA-384 and SHA-512 results contain 64, 96 and 128 hexadecimal characters respectively.
  5. Copy or download the result, then click Clear to remove the message, key and result from the form.

Example loads the public RFC 4231 message and the UTF-8 key Jefe; it is not a private key for your application. TXT and CSV exports include the algorithm and HMAC value, never the key or message. This page processes one text message at a time; file HMAC and line-by-line HMAC are not available.

Limits, privacy and next steps

The message is limited to 10 MiB of UTF-8 data; the decoded key is also limited to 10 MiB. A Hex key needs two hexadecimal digits per byte. HMAC runs in a Web Worker and can be cancelled. Keys are not saved to browser storage or included in URLs or exports. Clear the form when finished; releasing browser memory is not a certified secure-erasure guarantee. Normal page and asset requests still reach the host.

RFC 4231

Frequently asked questions

Why does the result disappear when I edit the key?

Editing the message, key, encoding or algorithm invalidates the previous result. Click Generate hash again. HMAC does not run automatically, so a stale value is never presented as a new calculation.

Are the UTF-8 key Jefe and the Hex key 4a656665 equivalent?

Yes. They describe the same four key bytes. Entering 4a656665 in UTF-8 mode instead uses eight text characters and is a different key.

What does an empty HMAC key mean?

The tool calculates standard HMAC with a zero-byte key; it does not replace it with another key. This is useful for test vectors, not for protecting real messages with a secret.

Can I calculate HMAC for files or each text line?

No. This page accepts one UTF-8 text message and one UTF-8 or Hex key. File hashing and line-by-line hashing are separate unkeyed tools.

Will copying or exporting include the key?

No. Copy retains only the full HMAC value. TXT and CSV include an identifier, the algorithm and result, not the message or key.