# HMAC-SHA512 Generator

Generate an HMAC-SHA512 tag from a message and a secret key. The tool encodes both as UTF-8, applies the RFC 2104 HMAC construction with SHA-512 and returns the 512-bit result in hex or Base64. Use it to test API signing schemes, such as some crypto exchange APIs and HS512 tokens, and to check your own implementation against a trusted reference. The key never appears in the response.

## Frequently asked questions

### What is HMAC-SHA512?

HMAC-SHA512 combines the SHA-512 hash with a secret key using the HMAC construction from RFC 2104. It proves that a message comes from someone who knows the key and was not changed. The tag is 64 bytes, or 128 hex characters.

### What is a known HMAC-SHA512 test vector?

RFC 4231 test case 2 uses the key Jefe and the message what do ya want for nothing?. The expected tag is 164b7a7bfcf819e2e395fbe73b56e0a387bd64222e831fd610270cd7ea2505549758bf75c05a994a6d034f65f8f0e6fdcaeab1a34d4a6b4b636e070a38bce737, which this tool reproduces.

### When should I use HMAC-SHA512 instead of HMAC-SHA256?

Use it when an API or token format requires it, for example the HS512 algorithm in JSON Web Tokens. HMAC-SHA256 is already strong, and SHA-512 mainly adds a longer tag and is often faster on 64-bit machines.

### How are the inputs encoded?

The message and the key are both taken as UTF-8 text. If your provider hands you a Base64 or hex secret that must be decoded first, the result here will differ from theirs.

### How long should my key be?

A random key of 64 bytes matches the SHA-512 output size and is a good choice. Keys longer than 128 bytes are hashed first, and very short keys weaken the security.

### Is the secret key kept private?

Yes. The key is used in memory only for this request and is left out of the response. It is never logged or stored.

### Can I create a JWT signature with this tool?

Partly. HS512 signs the Base64URL header, a dot and the Base64URL payload. Paste that string as the message, choose Base64 output and replace + with -, / with _ and remove the = padding to get the JWT signature part.

### Why does my result not match?

The most common causes are extra whitespace or line breaks in the message, a key that should have been decoded from hex or Base64, or comparing hex with Base64. Check each input byte for byte.

### Can I truncate the HMAC-SHA512 tag?

Some protocols use only the first part of the tag, for example HMAC-SHA512/256 variants in certain standards. The tool always returns the full 64 bytes, so cut it yourself if your protocol says so.

### What is the input limit?

The message and key together may be up to 5 MiB of text per request. That is enough for API request bodies, token strings and large webhook payloads.

Your ad here?

[Email us](mailto:hi@dennn.is?subject=Advertising%20on%20OneClick%20Pro)

[Ad The agent-ready plugin suite for WordPress.](https://sleekwp.com/?ref=oneclickpro)