HMAC Generator

HMAC-SHA256 over 28 UTF-8 byte(s): 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843.

How it works

• Read the secret key from the form; it stays in memory and is never stored or transmitted.
• Derived the inner and outer pads from the key (RFC 2104), hashing the key first when it is longer than the block size.
• Computed the 256-bit MAC over the UTF-8 message and formatted it as lower-case hex.

HMAC-SHA256(key, message) = 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843

• Computed with the bundled implementation, which matches the published known-answer vectors.
• HMAC authenticates a message with a shared secret; it is not encryption.

Methodology

1. Read the key as UTF-8 bytes and, when it is longer than the hash block size, replace it with its own digest.
2. Derive the inner (0x36) and outer (0x5c) padded keys and compute H((K xor opad) || H((K xor ipad) || message)) per RFC 2104 and FIPS 198-1.
3. Encode the message as UTF-8 so the MAC is locale-independent and matches the standard test vectors.
4. When the browser exposes the Web Crypto API, compute the MAC with crypto.subtle and cross-check it in tests against the bundled engine.

Usage

1. Enter the message to authenticate.
2. Enter the shared secret key (it is used in memory only).
3. Choose HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384 or HMAC-SHA-512 and read the hex MAC.

Examples

These are examples, not current values: they use fixed inputs, while the interactive tool computes live results in your browser.

RFC 4231 case 2, HMAC-SHA-256

{
  "text": "what do ya want for nothing?",
  "key": "Jefe",
  "algorithm": "sha256"
}

RFC 4231 case 2, HMAC-SHA-1

{
  "text": "what do ya want for nothing?",
  "key": "Jefe",
  "algorithm": "sha1"
}

RFC 4231 case 2, HMAC-SHA-512

{
  "text": "what do ya want for nothing?",
  "key": "Jefe",
  "algorithm": "sha512"
}

Limitations

Secret key handling

This page is a local computation surface: the key is read into memory, used to derive the pads, and discarded when the result is computed. It is not written to storage, not placed in the address bar, and not sent over the network. The tool records only the tool slug and a coarse surface event for analytics, never the values you type.

Treat the key as a credential regardless. If you paste it from a password manager, the clipboard and any keyboard-history or screen-sharing tooling are part of your threat model. Rotate any key you accidentally expose.

Where HMAC is used

HMAC is the standard building block for webhook signatures, signed cookies, API request authentication and keyed integrity checks. Because it is symmetric, both parties must already share the key through a separate secure channel.