HMAC-SHA-256 Hash Generator

How to use this HMAC-SHA-256 hash generator

Enter any text, then select Generate hash. For example, entering abc returns its HMAC-SHA-256 digest.

Use Copy or Export to reuse the generated value. This tool processes text in your browser.

About HMAC-SHA-256

HMAC combines a message with a shared secret key. HMAC-SHA-256 is widely used for message authentication when both parties securely share a key.

What HMAC-SHA-256 produces

HMAC-SHA-256 is a keyed message authentication code, not encryption. It combines a message and secret key through the HMAC construction, then returns a 256-bit tag shown here as 64 hexadecimal characters. A recipient who has the same key can recompute the tag to detect a changed message and authenticate its source.

How the calculation works

HMAC normalizes the key to the hash function's block size, combines it with distinct inner and outer padding values, and hashes the message in two stages. In compact notation, the method is H((K′ xor opad) || H((K′ xor ipad) || message)). Do not reproduce HMAC by merely joining a key and message before hashing; that is a different and often unsafe construction.

Worked example

Enter The quick brown fox jumps over the lazy dog as the message and key as the secret. The complete HMAC-SHA-256 result is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8. Repeating both inputs returns the same tag; changing capitalization, punctuation, spacing, or key changes it.

Assumptions, security, and limitations

HMAC-SHA-256 combines the RFC 2104 HMAC construction with SHA-256. It is a current, widely interoperable choice when a protocol specifies it, provided secret keys are random, protected, and shared securely.

Both parties must agree on exact message bytes, text encoding, key bytes, algorithm, and any tag truncation. This page treats typed text and key as text; it does not decode hexadecimal or Base64 key notation. A copied tag does not include those settings. Never paste a production secret into an unfamiliar or shared browser, and do not expose a secret beside its tag.

Calculation runs in this browser. Input is not submitted to Awesome Tools, but browser extensions, device monitoring, clipboard history, exported files, and shared-device access remain outside this page's control. Verify critical results with the exact algorithm and byte encoding required by your protocol.

Common mistakes

• Comparing text that differs by an invisible trailing newline, Unicode normalization, or character encoding
• Using a human-memorable key, reusing one key across unrelated systems, or comparing tags with ordinary non-constant-time application code
• Choosing an algorithm because its output is longer without checking the protocol's required algorithm and security guidance

HMAC-SHA-256 FAQ

Can two inputs have the same result?

Yes in principle because unlimited inputs map to fixed-length output. Security depends on how hard it is to find useful collisions or preimages, not on collisions being mathematically impossible.

Why does another tool return a different value?

Check encoding, capitalization, spaces, line endings, algorithm name, and output format. Also confirm the exact key representation and tag length.

Authoritative sources and related tools

Read the RFC Editor's RFC 2104 HMAC definition. Read NIST's FIPS 180-4 Secure Hash Standard and SP 800-131A transition guidance.

• SHA-256 Hash Generator
• SHA-512 Hash Generator
• HMAC-SHA-256 Hash Generator