Hashing
HMAC-SHA512 generator
HMAC-SHA512 signs a message with a secret key and returns a 128-character lowercase hex tag. Protocols that specify it want the wider output, and SHA-512's compression is fast on 64-bit CPUs. A keyed tag is not the plain SHA-512 digest of your message: without the shared secret the tag cannot be predicted or forged. Paste the message into the Input box and the secret into the Key box, read the Output box, then copy.
How to use HMAC-SHA512
- Open HMAC-SHA512 in the Toolbox101 app.
- Paste the message or payload you want to sign into the
Inputbox. - Type the shared secret into the
Keybox. If the key is hex or Base64 rather than plain text, setKey isto match. - Leave
OutputonHex, or pickBase64if the service you are signing for expects that. - Copy the 128-character tag from the
Outputbox.
Worked example
HMAC-SHA512 returns the output below for this combination.
Input
The quick brown fox jumps over the lazy dogKey
keyOutput
b42af09057bac1e2d41708e48a902e09b5ff7f12ab428a4fe86653c73dd248fb82f948a549f7b791a5b41915ee4d1ec3935357e4e2317250d0372afa2ebeeb3aCheck it yourself: open HMAC-SHA512 and enter the same input and key.
Frequently asked questions
What is HMAC-SHA512 used for in practice?
HMAC-SHA512 computes a keyed tag from a message and a shared secret, used wherever a protocol names SHA-512 as its MAC base: longer-lived credentials, webhook schemes, and binary formats with 64-byte signature fields. The wider tag costs a little more than HMAC-SHA256 and leaves more margin.
How is HMAC-SHA512 different from plain SHA-512?
Plain SHA-512 hashes a message alone, so anyone can compute it and alter the message without being noticed. HMAC-SHA512 mixes a secret key into the computation, so only parties holding the key can produce or verify the tag. A changed message changes the tag completely, and without the key the correct tag cannot be guessed.
What goes in the Input box and the Key box?
The Input box holds the exact message you are signing. The Key box holds the shared secret, and Key is says how to read it: as plain UTF-8 text, as hex, or as Base64, for keys that come as encoded bytes. A signing secret is real credential material, so use a throwaway key for tests where you can.
HMAC-SHA256 or HMAC-SHA512, which should I use?
Whichever your protocol specifies, since mixing them breaks verification. Where you choose freely, both are secure: HMAC-SHA256 is the common default for webhooks and API signing, while HMAC-SHA512 gives a longer tag. SHA-512 is often as fast or faster on 64-bit hardware, so the practical difference is small.