Sign a message with a secret key. The result is HMAC-SHA256, in lowercase hex.
1
HMAC is a keyed hash. RFC 2104, published in February 1997, defines it, and FIPS 198-1 updates the specification. The same message with a different key is a different result. Without the key, the result cannot be recomputed.
This page computes HMAC-SHA256 over the UTF-8 bytes of the message and of the key. The hex alphabet is 0-9 and a-f. An empty key is allowed: it is still a defined HMAC, and it is not a secret.
key: key message: The quick brown fox jumps over the lazy dog
f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
key: key, message empty
A 64-character hex digest. It is not the SHA-256 of the key alone.
Compare the result with SHA-256 of the message
Compare it with HMAC-SHA256 of the same key and the same bytes
Some APIs expect the key as raw bytes decoded from hex or base64. This page uses the UTF-8 bytes of the characters you type. A hex-looking key is not decoded.
The share link contains the key. Sending that link sends the key. Clear the key before you share, or do not share.
The digest comes from crypto.subtle.sign with the HMAC algorithm and SHA-256. That is the Web Cryptography API.
A trailing line break is part of the message. The Hash page has the same rule for an unkeyed digest.
RFC 2104 is dated February 1997. The authors are Mihir Bellare, Ran Canetti, and Hugo Krawczyk. The construction nests the hash twice, with inner and outer pads, so a plain hash of the key concatenated with the message is a different function.
FIPS 198-1, The Keyed-Hash Message Authentication Code, was published by NIST in July 2008. It approves HMAC with an approved hash such as SHA-256.