HMAC Calculator
Compute HMAC-SHA256 or HMAC-SHA512 of a message with a secret key, live as you type. Hex output, UTF-8 input, empty messages supported.
Your inputs and files stay in your browser
Key and message
Paste the message to sign (for example, a webhook body) or load an example.
Enter a secret key — the HMAC is calculated as you type.
On this page
HMAC Calculator computes a keyed message authentication code (RFC 2104) with SHA-256 or SHA-512 while you type. Use it to check webhook signatures or reproduce API request signing; the key and message stay in your browser.
Detailed Functionality
Enter a Secret Key and a Message; both are taken as UTF-8 text exactly as typed. The result is recalculated on every keystroke and on algorithm change, and is shown as lowercase hex: 64 characters for HMAC-SHA256, 128 for HMAC-SHA512. The calculation runs in a Rust/WebAssembly module in the page.
An empty message is a valid input: with key key, HMAC-SHA256 of an empty message is 5d5d139563c95b5967b9bd9a8c9b233a9dedb45072794cd232dc1b74832607d0, matching OpenSSL and other libraries. Without a key the output stays empty. Keys longer than the hash block (64 bytes for SHA-256, 128 for SHA-512) are first hashed, as the standard requires.
The key field accepts text only, so a secret that a service hands out as hex or Base64 must be entered in the form that service actually uses as the key. Results are checked against RFC 4231 test vectors. Nothing is stored: reloading the page clears both fields.
Practical Examples
Classic test vector: key key, message The quick brown fox jumps over the lazy dog, SHA-256 → f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8.
RFC 4231 test case 2: key Jefe, message what do ya want for nothing?, SHA-256 → 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843.
Empty message: key key with an empty message gives 5d5d139563c95b5967b9bd9a8c9b233a9dedb45072794cd232dc1b74832607d0, the same as printf '' | openssl dgst -sha256 -hmac key.
Checking a webhook: paste the raw request body as the message and the webhook secret as the key; if the provider sends sha256=<hex>, compare only the hex part with the result.
How to Use This Tool
Enter the key
Type or paste the shared secret into Secret Key.
Enter the message
Paste the exact bytes that were signed into Message, or leave it empty to MAC an empty string.
Choose the algorithm
Select SHA-256 or SHA-512 in Algorithm; the HMAC Result updates immediately (or click Calculate HMAC).
Copy or clear
Click Copy to take the hex value; Clear empties both fields.
Tips and Best Practices
- Sign exactly the bytes the server signed: reformatted JSON, a different key order or an added trailing newline all change the HMAC.
- Compare HMACs in constant time in your own code; the visual check here is for debugging only.
- A secret pasted with a trailing space or newline is a different key; check the field if results do not match.
- HMAC-SHA512 is not "twice as secure" for typical use; pick the algorithm the other side expects.
- If the expected value is Base64, it encodes the same bytes as the hex output: convert one into the other before comparing.