b2KIT

HMAC Generator

Generate HMAC (Hash-based Message Authentication Code) signatures using SHA-256, SHA-512, or SHA-1 with a secret key.

Tested tool guide Tested browser tools Checked August 16, 2026

What HMAC Generator does, with a checked example

The HMAC Generator turns a message, a secret key, and the chosen SHA-256, SHA-512, or SHA-1 option into a keyed authentication tag, often called an HMAC signature. It is useful for reproducing request signatures, webhook tags, and protocol test values. The usual mismatch is not the formula but the bytes: a trailing newline, altered JSON spacing, different text encoding, or treating a hexadecimal key as literal characters changes the tag. HMAC detects changes for parties sharing the key; it does not encrypt or conceal the message.

Worked example

A concrete input and expected output from the current implementation.

Input

Algorithm: SHA-256
Secret key: key
Message: The quick brown fox jumps over the lazy dog

Expected output

f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8

With the key and message interpreted as UTF-8 text and no trailing newline, HMAC-SHA-256 produces 32 tag bytes. Rendering those bytes as lowercase hexadecimal gives the 64-character value shown.

How the result is produced

1

Keyed hash construction

HMAC processes the secret key through standardized inner and outer padding steps around the message, using the selected hash function for both passes. The construction is keyed, so a plain SHA-256 digest of key-plus-message is not the same calculation. SHA-256, SHA-512, and SHA-1 yield 32-byte, 64-byte, and 20-byte tags respectively.

2

Bytes and representation

The calculation is over bytes, not displayed characters. For text fields, exact characters, line endings, spaces, and a final newline determine the message bytes; the key must also be interpreted consistently. The returned hexadecimal characters represent the tag bytes. Letter case in hexadecimal does not change those bytes, although a literal string comparison may be case-sensitive.

Good uses

  • Reproduce an HMAC-SHA-256 header while debugging a webhook whose provider specifies the raw request body and a shared signing secret.
  • Create a fixed expected tag for an automated test that checks an application's HMAC calculation against a known message and key.
  • Compare SHA-256, SHA-512, and SHA-1 results when diagnosing why two systems generate different authentication tags from apparently identical inputs.

Limits and checks

  • The message must match byte for byte. Parsing and reserializing JSON, changing whitespace, normalizing Unicode, or converting line endings can invalidate an otherwise correct comparison.
  • Another system may encode its tag as Base64 or expose only a truncated HMAC. A different-looking or shorter value does not by itself identify a different hash algorithm.
  • The calculation stays in the browser and nothing is uploaded, but secrets can still be exposed through clipboard history, screenshots, browser extensions, or anyone viewing the screen.

Common questions

Is an HMAC the same as a hash, encryption, or a digital signature?

No. A plain hash can be recomputed by anyone who has the message, while HMAC requires the shared secret to reproduce the tag. HMAC authenticates message bytes and can reveal that they changed, but it leaves the message readable. It is also not a public-key digital signature because sender and verifier use the same secret.

Why does my HMAC not match the value from another service?

First match the selected SHA variant, then compare the exact key and message bytes. Common causes are a hidden final newline, CRLF versus LF, reserialized JSON, Unicode normalization, a secret supplied as hexadecimal or Base64 rather than text, and hexadecimal versus Base64 output. If the other system signs a timestamp or prefix with the body, entering only the body cannot match.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.