HMAC combines a secret key with your message to produce an authentication tag. Pick the underlying hash and copy the hex result.
Secret key
Message
Hash
HMAC (hex)
How it works
Enter a secret and a message. The HMAC is computed with the selected hash function.
The output length depends on the hash: SHA-256 gives 32 bytes (64 hex chars), SHA-512 gives 64 bytes (128 hex), SHA-1 gives 20 bytes (40 hex).
What is HMAC?
HMAC provides message authentication: someone with the same secret can verify the tag was created with that key. It is not encryption; the message stays visible.
Secrets
Do not share your secret in URLs or email. This page does not transmit your key; still avoid pasting production secrets on shared machines.
Common questions
- Which hash should I pick?
- Prefer SHA-256 or SHA-512 for new work. SHA-1 is legacy only.
- Is the secret stored?
- No. Everything runs locally.
- Can I verify a server HMAC?
- Yes, if you use the same key, message, and hash algorithm, the hex should match.
- Is this encryption?
- No. HMAC authenticates; it does not hide the message.