Micro Tools
Advertisement

HMAC-MD5 generator

Compute HMAC-MD5 for a message and secret key in your browser. HMAC adds a key to hashing, producing a message authentication code.

Input

Enter the message and the secret key. The 128-bit tag is deterministic for each pair.

The crypto library loads from a CDN on first use, then everything runs locally. Nothing you type is uploaded.
HMAC-MD5 tag

The authentication tag appears below in hexadecimal.

-
Advertisement

What HMAC does

HMAC (RFC 2104) turns any hash function into a message authentication code: it hashes the key padded with an inner pad, then hashes the result with the key padded with an outer pad. Only someone holding the secret key can produce or verify the tag, which proves both integrity and authenticity of the message.

Why MD5 is a weak choice

HMAC-MD5's security does not collapse the way raw MD5 collisions do, and no practical HMAC-MD5 forgery is known, but the 128-bit tag is below modern strength recommendations and MD5's reputation is poor. Prefer HMAC-SHA256 for anything new; keep HMAC-MD5 for legacy compatibility.

Related tools

JSON formatterFormat and validate JSON, privately. Regex testerTest regex live with highlighting. Base64 encoderBase64 encode and decode, plus URL encoder and JWT decoder.

HMAC-MD5 FAQs

What is HMAC used for?
API request signing, webhook verification, and password-adjacent integrity checks: the sender computes the tag with a shared secret and the receiver recomputes it to confirm the message is genuine and unaltered.
Is HMAC-MD5 secure?
No practical forgery attack is known, but with only 128-bit tags and a broken underlying hash it is not recommended for new systems. Use HMAC-SHA256 or HMAC-SHA512.
How long should the key be?
At least 128 bits (16 random bytes) for HMAC-MD5; longer keys are hashed down to the block size anyway. Never use a predictable or short password as the key.
Does the key stay private?
Yes. The key is used only inside your browser to compute the tag and is never transmitted anywhere.
HMAC vs plain hash?
A plain hash proves nothing about who created the message; anyone can hash. HMAC binds the tag to a secret key, so only key holders can create valid tags.
Advertisement