How to use it
- Type the data into Message. For binary data, choose Hexadecimal or Base64 under Message encoding.
- Type the secret into Key and choose how it is written under Key encoding.
- Read the four rows of HMAC values. Copy the value you need, or compare it with the value your system gives.
- If the values differ from another system, check the bytes first: a different line ending or encoding gives a different HMAC.
What an HMAC is
An HMAC (RFC 2104) is a message authentication code: a short value that only someone who knows the secret key can make. It is built from an ordinary hash function H, applied twice to the message and the key, so the same hash can be used for the four rows of the table. Because the key is needed, a matching HMAC shows that the message was not changed and that it came from a holder of the key.
An HMAC does not hide the message. Anyone who has the message can read it; the HMAC only lets them check it.
HMAC(K, m) = H((K XOR opad) || H((K XOR ipad) || m))
ipad = the byte 0x36 repeated B times
opad = the byte 0x5C repeated B times
B = the block size of H: 64 bytes for SHA-1 and SHA-256, 128 bytes for SHA-384 and SHA-512Which hash and which key
HMAC-SHA-256 is the usual choice, and the one many webhooks and APIs use. HMAC-SHA-512 is the same construction with a longer output. HMAC-SHA-1 still appears in older systems, and it is not a choice for new designs.
The key should be random and at least as long as the hash output. A key typed as a word or a short phrase is easy to guess, and a guessed key makes the HMAC worthless.
Hexadecimal and Base64
Both forms show the same bytes. Hexadecimal writes each byte as two digits, so SHA-256 has 64 digits. Base64 writes three bytes as four characters, so SHA-256 has 44 characters, the last of them a = for padding (RFC 4648).
- HMAC-SHA-1: 40 hexadecimal digits, 28 Base64 characters
- HMAC-SHA-256: 64 hexadecimal digits, 44 Base64 characters
- HMAC-SHA-384: 96 hexadecimal digits, 64 Base64 characters
- HMAC-SHA-512: 128 hexadecimal digits, 88 Base64 characters
Worked example: RFC 4231 test case 2
The key Jefe and the message what do ya want for nothing? are the second test case of RFC 4231 for SHA-256, SHA-384 and SHA-512, and of RFC 2202 for SHA-1. The table below is what the page shows for them, and its HMAC-SHA-256 value is the one the RFC prints: 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843.
| Algorithm | Hexadecimal | Base64 |
|---|---|---|
| HMAC-SHA-1 | effcdf6ae5eb2fa2d27416d5f184df9c259a7c79 | 7/zfauXrL6LSdBbV8YTfnCWafHk= |
| HMAC-SHA-256 | 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843 | W9zBRr9gdU5qBCQmCJV1x1oAPwidJzmDnexYuWTsOEM= |
| HMAC-SHA-384 | af45d2e376484031617f78d2b58a6b1b9c7ef464f5a01b47e42ec3736322445e8e2240ca5e69e2c78b3239ecfab21649 | r0XS43ZIQDFhf3jStYprG5x+9GT1oBtH5C7Dc2MiRF6OIkDKXmnix4syOez6shZJ |
| HMAC-SHA-512 | 164b7a7bfcf819e2e395fbe73b56e0a387bd64222e831fd610270cd7ea2505549758bf75c05a994a6d034f65f8f0e6fdcaeab1a34d4a6b4b636e070a38bce737 | Fkt6e/z4GeLjlfvnO1bgo4e9ZCIugx/WECcM1+olBVSXWL91wFqZSm0DT2X48Ob9yuqxo01Ka0tjbgcKOLznNw== |
Frequently asked questions
Is an HMAC the same as encrypting the message?
No. An HMAC does not hide the message, so anyone can read it. It shows that the message was not changed and that the sender knows the key. For secrecy you need encryption.
What is the difference between a hash and an HMAC?
A hash depends only on the message, so anyone can compute it. An HMAC also needs the secret key, so only someone with the key can make or check it. For plain digests, use the hash generator.
Why does my HMAC differ from the one my library gives?
The key or the message bytes differ. A key typed as text is its UTF-8 bytes, and the same letters written in hexadecimal are different bytes. A line break at the end of the message also changes the HMAC.
Which key length should I use?
Use a random key at least as long as the hash output: 32 bytes for HMAC-SHA-256. RFC 2104 strongly discourages a shorter key, and a key made from words or a short phrase is easy to guess.
Can I check a webhook signature with this page?
Yes, if you use the exact bytes that were signed. Webhook signatures are usually computed over the raw request body, so paste the body unchanged: a re-formatted JSON body gives a different HMAC.
Is my key or message sent anywhere?
No. The HMAC is computed in your browser with the browser's own SubtleCrypto. The key and the message are not uploaded or stored.
Sources
- RFC 2104: HMAC: Keyed-Hashing for Message Authentication
- RFC 4231: Identifiers and Test Vectors for HMAC-SHA-224, HMAC-SHA-256, HMAC-SHA-384 and HMAC-SHA-512
- RFC 2202: Test Cases for HMAC-MD5 and HMAC-SHA-1
- RFC 4648: The Base16, Base32, and Base64 Data Encodings
- NIST FIPS 180-4: Secure Hash Standard (SHA-1 and the SHA-2 family)
Figures and text last checked on Tuesday, November 10, 2026.