Micro Tools
Advertisement

HMAC-SHA1 generator

Compute HMAC-SHA1 for a message and secret key in your browser. HMAC-SHA1 produces a 160-bit authentication tag from any message.

Input

Enter the message and the secret key. Powers TOTP authenticator codes.

The crypto library loads from a CDN on first use, then everything runs locally. Nothing you type is uploaded.
HMAC-SHA1 tag

The authentication tag appears below in hexadecimal.

-
Advertisement

TOTP and HMAC-SHA1

HMAC-SHA1 is the engine inside TOTP, the time-based one-time passwords from RFC 6238 used by authenticator apps. The shared secret and the current 30-second counter are HMACed, then truncated to 6-8 digits. Billions of logins a day rely on this construction.

Security standing

Like HMAC-MD5, HMAC-SHA1 has no practical forgery attack despite SHA-1's collision breaks, because HMAC does not rely on collision resistance the same way. Still, 160-bit tags are legacy strength; HMAC-SHA256 is the modern default for new protocols.

Related tools

JSON formatterFormat and validate JSON, privately. Regex testerTest regex live with highlighting. Base64 encoderBase64 encode and decode, plus URL encoder and JWT decoder.

HMAC-SHA1 FAQs

Where is HMAC-SHA1 used?
TOTP two-factor codes, older AWS signature versions, some OAuth 1.0a signatures, and PBKDF2 key derivation historically defaulted to HMAC-SHA1.
Is HMAC-SHA1 broken like SHA-1?
No. The SHAttered collision broke SHA-1's collision resistance, but HMAC's security proof needs less, and no practical HMAC-SHA1 forgery exists. Migration to SHA-256 is still wise.
What does the output look like?
A 40-character hexadecimal string (160 bits), deterministic for a given key and message.
Can I use an empty key?
Technically yes, but an empty or weak key destroys the security. Use a random key of at least 16 bytes.
Key privacy?
The key never leaves your browser; the HMAC is computed locally with a CDN-loaded crypto library.
Advertisement