Input
Preparing your workspace…
How to use
- Enter a message and key, choosing an encoding for each.
- Select a SHA-1 / SHA-2 / SHA-3 algorithm and Generate.
- Copy the digest, compare an expected value or download JSON.
HMAC Generator
HMAC combines a hash function with a secret key to produce a message authentication code. The message and key are separate byte sequences; their encodings must agree with the system you are testing.
Use explicit message and key encodings when reproducing signatures from another system. The output can be copied as Hex or Base64 without exporting either input.
Work with the input
Enter the message and secret key. Select UTF-8, Hex or Base64 separately for each.
Choose a SHA-1 / SHA-2 / SHA-3 algorithm and select Generate. Copy the Hex or Base64 digest, or compare an expected value.
message: The quick brown fox jumps over the lazy dog
key: key
HMAC-SHA-256f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8Example data only. Never reuse sample secrets as real credentials.
Behavior and limits
The exact message bytes are used. There is no automatic JSON formatting, query sorting or signature canonicalization. This is a local comparison utility, not a server-side timing-safe authentication verifier. Empty messages are allowed; an empty secret key is not accepted here.
Copy and reuse
Share only what your protocol requires. Downloaded result files do not include the message or secret key.
Copy all digests · Comparison uses the selected output format. With All algorithms, any matching digest is identified.
Input: 1 MiB; Secret key: 64 KiB; File: 1 GiB; Passwords: 4–128 (Length), 1–100 (Count); bcrypt: 1–72 UTF-8 bytes · cost 4–14 · default 10; AES: Plaintext 1 MiB, Passphrase 1 KiB, GCM / CBC / CTR / CFB / ECB, 128/192/256-bit; PBKDF2 / HKDF: Password / input bytes 64 KiB, Salt / info 1 KiB, Output length (bytes) 1–256; 1–256 output bytes · up to 2,000,000 PBKDF2 iterations · inputs stay on your device; Time: 30 s; File: 120 s.
Frequently asked questions
Is HMAC the same as an ordinary hash?
No. HMAC uses a secret key as well as the message. The same key and message bytes are needed to reproduce the code.
Why does my API signature not match?
Check the required algorithm, key encoding and exact bytes the API signs. Some protocols require a canonical representation rather than the visible message alone.
Can the message and key use different encodings?
Yes. Select UTF-8, Hex or Base64 independently for each input. The selected encodings determine the bytes used for HMAC.
Are keys included in downloads?
No. Result JSON contains the algorithm, digest, output format and message byte count. It excludes both the message and key.
Does the tool send my key to an API?
No. HMAC is calculated locally. It does not send a request, construct an API-specific signing string or manage credentials.