How to Generate an HMAC

Before you begin

An HMAC is a value generated from text, a secret, and a selected hashing algorithm. Use this generator when you need to calculate one from a message, request content, an order string, or another piece of text. The three inputs are optional: text and secret start empty, while the algorithm starts at SHA-256. To receive a generated HMAC, the text must contain at least one character and the selected algorithm must be usable.

Prepare the precise text and secret before you begin. Characters such as spaces, punctuation, capitalization, separators, and line breaks can be part of the text being processed. If you are comparing the result with a value from another calculation, preserve those characters and use the same algorithm selection. A small input difference can produce a different HMAC value, so copying the intended string carefully helps keep the comparison meaningful.

Generate the HMAC

1. Enter the complete text in the text field. Use the form required for your task, such as a message or a request string, and do not add surrounding spaces unless they belong to the intended text.

2. Enter the secret in the secret field. Although this input is optional, an empty secret with non-empty text causes the generator to substitute an internal fallback secret. Enter the secret associated with your task when the result needs to correspond with another calculation.

3. Select the hashing algorithm. Leaving the selection unchanged keeps SHA-256 as the default. If you provide another algorithm name, generation depends on that name resolving to an algorithm the available hashing library can use.

4. Start the generation action after checking the text, secret, and algorithm. When the text is non-empty and the selected algorithm is usable, the result contains a generated HMAC.

5. Compare the returned value only after checking that the other calculation used the same text, secret, and algorithm. During troubleshooting, reproduce the input without changing encoding, capitalization, punctuation, spacing, or line breaks.

Read the returned value

A successful result containing an HMAC shows that the generator processed non-empty text with an algorithm name it could use. The value is determined by the text, the secret applied during generation, and the selected algorithm, so changing one of these inputs can account for a difference between two results.

Empty text has a separate outcome. The generator reports success with an empty HMAC value instead of performing the HMAC calculation. Read that outcome as an empty value rather than as a computed cryptographic result, and enter the text before trying to generate a value.

An algorithm name that does not resolve to a usable hashing implementation is not converted into a structured failure by the generator. If the expected successful result is absent, review the algorithm name and select one that can be resolved. A blank secret also needs attention: with non-empty text, the internal fallback is applied, so that output does not represent a calculation using a particular external secret.

Worked example

A developer needs an HMAC for the non-empty order string order=4821&amount=19.95 and chooses the default SHA-256 selection.

Enter the text "order=4821&amount=19.95", enter the secret chosen for the order system, leave SHA-256 selected, and start generation.

A successful result containing a generated HMAC value for the entered order string, supplied secret, and selected SHA-256 algorithm.

Limitations

• Generation is limited to algorithm names that resolve to a usable implementation, and empty text does not produce a computed HMAC.

Common errors

• Leaving the secret blank can create a value with the internal fallback instead of the intended secret. Enter the intended secret and start generation again before comparing the new result.

FAQ

Do I need to enter a secret?

For non-empty text, entering a secret is optional, but leaving that field empty makes the generator apply an internal fallback. Supply the intended secret when the output must correspond to another HMAC calculation.

What happens if the text is empty?

An empty text field produces success with an empty HMAC value instead of carrying out the calculation. Add the text you intend to process when you need a generated HMAC.

Which algorithm should I choose?

SHA-256 is the default selection. Another algorithm name may be supplied, but generation is limited to names that resolve to a usable hashing implementation rather than names the generator cannot resolve.