HesapHanem

HMAC Generator

Create a keyed-hash message authentication code from text and a key.

Result

7b77ae021175ae405bff9d1e83b136dde61744ff

How it is calculated

HMAC mixes a secret key into a hash so that only someone who knows the key can produce or check the value: HMAC(K, m) = H((K ⊕ opad) ‖ H((K ⊕ ipad) ‖ m)), where H is the chosen hash, m the message text and K the key. The tool supports SHA-256 (the default), SHA-1, MD5 and SHA-512, and any other value falls back to SHA-256. Both the text and the key must be filled in. The output is lowercase hexadecimal: 64 characters for SHA-256, 128 for SHA-512, 40 for SHA-1 and 32 for MD5. The same text, key and algorithm always give the same value, and even a one-character change gives a completely different one.

Worked example

The message is order=1042&amount=59.90, the key is s3cret-key and the algorithm is SHA-1. The tool applies the HMAC construction to the text bytes and returns 40 hex characters: 7b77ae021175ae405bff9d1e83b136dde61744ff. A server that holds the same key recomputes this value from the received message and compares it with the one sent; if one character of the message changes, the values no longer match.

Try this example →

Common mistakes

  • Adding a trailing space or line break to the text or key. It is part of the input, so the result changes completely.
  • Comparing HMACs produced with different algorithms. SHA-1 and SHA-256 outputs for the same input will never match.
  • Treating HMAC as encryption. The message is not hidden and cannot be recovered from the value; it only proves integrity and knowledge of the key.
  • Using a short or guessable key. Security rests on the key, so a weak key can be found by guessing.
  • Pasting a real production secret into any online tool; use a test key.

About this calculator

This tool generates an HMAC (Hash-based Message Authentication Code) — a cryptographic construction that combines a secret key with a hash function (SHA256, SHA1, MD5, or SHA512) to verify both the integrity and authenticity of a message. Unlike a plain hash, an HMAC can't be reproduced without knowing the secret key, so it proves the message wasn't tampered with and came from someone who holds that key.

Developers use HMACs to sign API requests (many REST APIs authenticate calls this way), verify webhook payloads, protect JWTs, and secure session tokens. SHA256 is the current standard for most security-sensitive uses, since MD5 and SHA1 are considered cryptographically weak.

Was this helpful?

You can pick up to 3 reactions.

Comments (1)

  • Editorial team

    The output is a hexadecimal tag, and the same text and key always give the same tag, so it is handy for checking a webhook signature or API request. Both sides must use identical bytes, including spaces and line endings, or the tags will differ. Avoid pasting a real production secret into any web page, and prefer SHA-256 or SHA-512 over MD5 or SHA-1 for new work. If your tag does not match a server, which algorithm does it use?

Popular calculators

Loan Calculator

Monthly payment, total interest and full amortization schedule.

Percentage Calculator

Percent change, percent of, and ratio calculations.

Discount Calculator

Calculate final price, savings, and discount amount.

BMI Calculator

Body mass index from height and weight (metric or imperial).

Age Calculator

Compute your exact age in years, months and days from a birth date.

Compound Interest Calculator

Calculate the final amount and interest earned with compounding.

All Calculators