HMAC-SHA512 Generator
Generate an HMAC-SHA512 tag from a message and a secret key. The tool encodes both as UTF-8, applies the RFC 2104 HMAC construction with SHA-512 and returns the 512-bit result in hex or Base64. Use it to test API signing schemes, such as some crypto exchange APIs and HS512 tokens, and to check your own implementation against a trusted reference. The key never appears in the response.
Frequently asked questions
What is HMAC-SHA512?
HMAC-SHA512 combines the SHA-512 hash with a secret key using the HMAC construction from RFC 2104. It proves that a message comes from someone who knows the key and was not changed. The tag is 64 bytes, or 128 hex characters.
What is a known HMAC-SHA512 test vector?
RFC 4231 test case 2 uses the key Jefe and the message what do ya want for nothing?. The expected tag is 164b7a7bfcf819e2e395fbe73b56e0a387bd64222e831fd610270cd7ea2505549758bf75c05a994a6d034f65f8f0e6fdcaeab1a34d4a6b4b636e070a38bce737, which this tool reproduces.
When should I use HMAC-SHA512 instead of HMAC-SHA256?
Use it when an API or token format requires it, for example the HS512 algorithm in JSON Web Tokens. HMAC-SHA256 is already strong, and SHA-512 mainly adds a longer tag and is often faster on 64-bit machines.
How are the inputs encoded?
The message and the key are both taken as UTF-8 text. If your provider hands you a Base64 or hex secret that must be decoded first, the result here will differ from theirs.
How long should my key be?
A random key of 64 bytes matches the SHA-512 output size and is a good choice. Keys longer than 128 bytes are hashed first, and very short keys weaken the security.
Is the secret key kept private?
Yes. The key is used in memory only for this request and is left out of the response. It is never logged or stored.
Can I create a JWT signature with this tool?
Partly. HS512 signs the Base64URL header, a dot and the Base64URL payload. Paste that string as the message, choose Base64 output and replace + with -, / with _ and remove the = padding to get the JWT signature part.
Why does my result not match?
The most common causes are extra whitespace or line breaks in the message, a key that should have been decoded from hex or Base64, or comparing hex with Base64. Check each input byte for byte.
Can I truncate the HMAC-SHA512 tag?
Some protocols use only the first part of the tag, for example HMAC-SHA512/256 variants in certain standards. The tool always returns the full 64 bytes, so cut it yourself if your protocol says so.
What is the input limit?
The message and key together may be up to 5 MiB of text per request. That is enough for API request bodies, token strings and large webhook payloads.