HMAC-SHA-1 Hash Generator

How to use this HMAC-SHA-1 hash generator

Enter any text, then select Generate hash. For example, entering abc returns its HMAC-SHA-1 digest.

Use Copy or Export to reuse the generated value. This tool processes text in your browser.

About HMAC-SHA-1

HMAC combines a message with a shared secret key. SHA-1 is legacy; use a current protocol-approved algorithm for new security-sensitive systems.

What HMAC-SHA-1 produces

HMAC-SHA-1 is a keyed message authentication code, not encryption. It combines a message and secret key through the HMAC construction, then returns a 160-bit tag shown here as 40 hexadecimal characters. A recipient who has the same key can recompute the tag to detect a changed message and authenticate its source.

How the calculation works

HMAC normalizes the key to the hash function's block size, combines it with distinct inner and outer padding values, and hashes the message in two stages. In compact notation, the method is H((K′ xor opad) || H((K′ xor ipad) || message)). Do not reproduce HMAC by merely joining a key and message before hashing; that is a different and often unsafe construction.

Worked example

Enter The quick brown fox jumps over the lazy dog as the message and key as the secret. The complete HMAC-SHA-1 result is de7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9. Repeating both inputs returns the same tag; changing capitalization, punctuation, spacing, or key changes it.

Assumptions, security, and limitations

HMAC-SHA-1 has different security properties from an unkeyed SHA-1 signature hash, but SHA-1 is a legacy choice and new designs should use a current protocol-approved MAC such as HMAC-SHA-256. Maintain it only where compatibility requires it.

Both parties must agree on exact message bytes, text encoding, key bytes, algorithm, and any tag truncation. This page treats typed text and key as text; it does not decode hexadecimal or Base64 key notation. A copied tag does not include those settings. Never paste a production secret into an unfamiliar or shared browser, and do not expose a secret beside its tag.

Calculation runs in this browser. Input is not submitted to Awesome Tools, but browser extensions, device monitoring, clipboard history, exported files, and shared-device access remain outside this page's control. Verify critical results with the exact algorithm and byte encoding required by your protocol.

Common mistakes

• Comparing text that differs by an invisible trailing newline, Unicode normalization, or character encoding
• Using a human-memorable key, reusing one key across unrelated systems, or comparing tags with ordinary non-constant-time application code
• Choosing an algorithm because its output is longer without checking the protocol's required algorithm and security guidance

HMAC-SHA-1 FAQ

Can two inputs have the same result?

Yes in principle because unlimited inputs map to fixed-length output. Security depends on how hard it is to find useful collisions or preimages, not on collisions being mathematically impossible.

Why does another tool return a different value?

Check encoding, capitalization, spaces, line endings, algorithm name, and output format. Also confirm the exact key representation and tag length.

Authoritative sources and related tools

Read the RFC Editor's RFC 2104 HMAC definition. Read NIST's FIPS 180-4 Secure Hash Standard and SP 800-131A transition guidance.

• SHA-256 Hash Generator
• SHA-512 Hash Generator
• HMAC-SHA-256 Hash Generator