RFC 4231 fixture
Use message Hi There, a hexadecimal key containing 0b repeated 20 times, and SHA-256. The full tag is b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7.
1. Message bytes
2. Shared key
An encoded key is decoded before use. For example, hex 616263 means the three bytes “abc”, not the six text characters “616263”.
Message, key, and tag remain in this page’s memory. This tool never writes them to a URL, browser storage, or a server. Copy and download export only the tag. Limits: 250,000 UTF-16 code units per input and 64 KiB decoded key. An empty key is unsupported. No trimming, normalization, or newline is added. Web Crypto requires HTTPS; the key is imported as nonextractable.
HMAC authenticates bytes using a shared secret; it does not encrypt the message. This visual comparison is for troubleshooting and is not a server-side constant-time verifier.
Conversions run locally in your browser. This tool does not upload input or save it to browser storage.
How to use the HMAC Generator
- 01
Enter a message and select its encoding. An empty message is valid.
- 02
Enter a nonempty single-line key and explicitly choose UTF-8, hex, Base64, or Base64url key encoding.
- 03
Choose the HMAC hash and generate the full authentication tag.
- 04
Select an output representation, compare an optional full hex tag, or copy/download the tag. Clear the fields when finished.
Examples
Key encoding matters
Hex 616263 becomes the same three key bytes as UTF-8 abc. UTF-8 616263 is six different bytes and therefore produces a different tag.
Match the protocol exactly
HMAC combines a secret key, the message bytes, and a selected hash function. Different whitespace, serialization, Unicode normalization, or line endings can change the message bytes. This tool adds no newline, trims no text, and performs no normalization.
Authentication is different from encryption
An HMAC tag helps parties that share a secret authenticate a message. It does not conceal the message and does not prove which holder of the shared key created it. Use the exact hash, output alphabet, and any truncation rules required by your protocol; this tool always generates the full tag.
Local handling and export scope
The key is imported into Web Crypto as nonextractable. Input values remain in page memory; the tool does not write them to URLs or browser storage. Copy and download export only the selected tag. A visual equality check is useful for debugging, but is not a replacement for constant-time verification in a server implementation.
What to know
- 250,000 UTF-16 code units per input and a 64 KiB decoded-key limit. Single-line key field.
- Modern browser and HTTPS required. Full-length tags only; no automatic truncation or server-side constant-time verification.
Common questions
Can I use a Base64url secret?
Yes. Choose that key encoding explicitly. Correct omitted padding is accepted; incorrect alphabets, padding, or unused bits are rejected.
Does a blank message mean there is no HMAC?
No. A zero-byte message has a valid HMAC under a nonempty key. Blank keys are unsupported by the browser Web Crypto import used here.
Why is SHA-1 available?
Some existing HMAC protocols specify it. The option is labeled legacy; choose SHA-256 or stronger for a new integration unless your protocol defines another choice.