HMAC generator
Compute an HMAC-SHA-256, SHA-1, SHA-384 or SHA-512 message authentication code with a secret key, on your device.
A clear answer. Here’s how.
HMAC(K, m) = H((K′ ⊕ opad) ‖ H((K′ ⊕ ipad) ‖ m)) as defined in RFC 2104, where K′ is the key padded with zeros to the hash’s block size (or hashed first when it is longer), ipad is 0x36 repeated and opad is 0x5c repeated. The tool calls the browser’s Web Crypto implementation, so the result is the same one a server library gives. The key is treated as secret: it is masked, never put in a shareable link and never sent anywhere. HMAC-MD5 is not offered because Web Crypto does not support it.
How this is checked
4 reference checks passed These 4 cases were run when this page was built, on 20 October 2026, and all reproduce within the stated tolerance. The same cases are part of the automated tests that run on every change to Toolmoz. Engine version 1.
See the checks and where each expected answer comes from
Case 1
- Inputs
- Message what do ya want for nothing?Message is utf8Secret key JefeKey is utf8Hash SHA-256Show the MAC as hex
- Expected, and what Toolmoz gave
- HMAC (hex) expected 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843, Toolmoz 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843
- Where the expected answer comes from
- RFC 4231 test case 2 (HMAC-SHA-256)
- Allowed difference
- exact
Case 2
- Inputs
- Message what do ya want for nothing?Message is utf8Secret key JefeKey is utf8Hash SHA-1Show the MAC as hex
- Expected, and what Toolmoz gave
- HMAC (hex) expected effcdf6ae5eb2fa2d27416d5f184df9c259a7c79, Toolmoz effcdf6ae5eb2fa2d27416d5f184df9c259a7c79
- Where the expected answer comes from
- RFC 2202 test case 2 (HMAC-SHA-1)
- Allowed difference
- exact
Case 3
- Inputs
- Message Hi ThereMessage is utf8Secret key 0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0bKey is hexHash SHA-256Show the MAC as hex
- Expected, and what Toolmoz gave
- HMAC (hex) expected b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7, Toolmoz b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7
- Where the expected answer comes from
- RFC 4231 test case 1 (a 20-byte key of 0x0b)
- Allowed difference
- exact
Case 4
- Inputs
- Message what do ya want for nothing?Message is utf8Secret key JefeKey is utf8Hash SHA-512Show the MAC as hex
- Expected, and what Toolmoz gave
- HMAC (hex) expected 164b7a7bfcf819e2e395fbe73b56e0a387bd64222e831fd610270cd7ea2505549758bf75c05a994a6d034f65f8f0e6fdcaeab1a34d4a6b4b636e070a38bce737, Toolmoz 164b7a7bfcf819e2e395fbe73b56e0a387bd64222e831fd610270cd7ea2505549758bf75c05a994a6d034f65f8f0e6fdcaeab1a34d4a6b4b636e070a38bce737Key length (bytes) expected 4, Toolmoz 4
- Where the expected answer comes from
- RFC 4231 test case 2 (HMAC-SHA-512), key Jefe is 4 bytes
- Allowed difference
- exact
What this shows: the engine reproduces independently worked values for these cases. It does not prove every possible input is right. To test an answer you were given, see how to check a number; to see what is and is not checked across Toolmoz, see the accuracy ledger.