HMAC-SHA1 Generator
Calculate an HMAC-SHA1 tag from a message and a secret key. The tool encodes both as UTF-8, applies the RFC 2104 HMAC construction with SHA-1 and returns the 160-bit result as 40 hex characters or in Base64. It helps developers working with OAuth 1.0a signatures, TOTP internals, older webhooks and legacy APIs that still sign with HMAC-SHA1. Your key stays in the request.
Frequently asked questions
What is HMAC-SHA1?
HMAC-SHA1 is a message authentication code that combines SHA-1 with a secret key, following RFC 2104. The tag is 20 bytes, shown as 40 hex characters or 28 Base64 characters.
Is HMAC-SHA1 still safe even though SHA-1 is broken?
SHA-1 collisions do not break HMAC-SHA1, because HMAC security depends on other properties of the hash. HMAC-SHA1 is still considered acceptable for existing systems. For new designs, prefer HMAC-SHA256.
What is a known HMAC-SHA1 test vector?
RFC 2202 test case 2 uses the key Jefe and the message what do ya want for nothing? and expects effcdf6ae5eb2fa2d27416d5f184df9c259a7c79. This tool returns that tag.
How do I build an OAuth 1.0a signature?
Use the signature base string as the message and the consumer secret and token secret joined with an ampersand as the key. Choose Base64 output, then percent-encode the result for the Authorization header.
Does TOTP use HMAC-SHA1?
Yes. Most authenticator apps compute HMAC-SHA1 over an 8-byte time counter with a Base32-decoded secret. Because that key and counter are binary, this text-based tool cannot reproduce a TOTP code directly.
How are key and message encoded?
Both are converted to UTF-8 bytes exactly as typed. Hidden whitespace, a different line ending or a key that must be decoded from hex or Base64 are the usual reasons for a mismatch.
Is my key sent back in the result?
No. The response contains only the tag and the non-secret options. The key is not logged or stored.
Which output format should I select?
Use hex if the other side shows a 40-character lowercase string, and Base64 if it shows 28 characters ending in =. Both are the same 20 bytes.
Can I use an empty key?
Yes, HMAC accepts an empty key and the tool computes it. An empty key gives no protection, so use it only to compare with test vectors or other tools.
How long can the message be?
The message and key together may be up to 5 MiB of text per request. The tag is computed immediately and neither input is stored.