HMAC-MD5 Generator

Generate an HMAC-MD5 message authentication code from a plaintext message and shared secret key.

Secret:

Input

Loading editor...

Output

Output will appear here...

What is HMAC-MD5 Generator

Last reviewed: April 18, 2026

HMAC (Hash-based Message Authentication Code) combines a cryptographic hash with a secret key to verify both the integrity and authenticity of a message.

HMAC-MD5 Generator takes a plaintext message and a shared secret key and returns the RFC 2104 HMAC-MD5 signature as a 32-character hexadecimal digest.

Although MD5 on its own is weak, HMAC-MD5 remains in use by legacy APIs and some embedded protocols, so having a quick browser tool is handy when debugging older systems.

Why use it

Reproduce HMAC-MD5 signatures for legacy APIs and integrations.
Debug request-signing mismatches on older systems.
Produce reference vectors while migrating to stronger HMAC-SHA256 schemes.
Avoid spinning up OpenSSL or Postman just to sign one test payload.
Quickly verify server-side HMAC-MD5 implementations.

Features

RFC 2104 HMAC-MD5 digest in hex
Client-side, so keys never leave your device
Matches OpenSSL `dgst -md5 -hmac`
Instant output as you type
Legacy-friendly for SNMP and embedded APIs

How to use HMAC-MD5 Generator

Enter the message. Paste the payload you want to sign into the input panel.
Set the secret. Type or paste the shared secret key in the Secret field.
Copy the signature. The 32-character hex HMAC-MD5 signature appears in the output; copy it into your request header.

Example (before/after)

Message + key

message: legacy-token
key: md5-legacy-key

HMAC-MD5 hex digest

c5cdc7b5d36094a7a0bdef05b13d4bbe

Common errors

Treating HMAC-MD5 as strong

MD5 has known collision issues. HMAC-MD5 is still considered acceptable for authentication because of the secret key, but it should be retired when possible.

Fix: Plan migration to HMAC-SHA256 or HMAC-SHA512.

Mixing up raw MD5 and HMAC-MD5

Calling MD5 on a concatenated string is not the same as HMAC-MD5.

Fix: Use the HMAC construction (ipad/opad) via this tool or a standard library.

Using the wrong key encoding

Servers often expect keys in UTF-8, base64, or hex. Passing the wrong form yields a different signature.

Fix: Match the key encoding your peer expects before generating the signature.

FAQ

Is HMAC-MD5 secure?

It is still considered acceptable for message authentication because of the secret key, but MD5 is weak for other uses and HMAC-SHA256 is preferred for new systems.

Why would I still use HMAC-MD5?

To integrate with legacy APIs that require it, including some SNMP and embedded device protocols.

What length is the output?

128 bits (32 hex characters).

Does my key leave my browser?

No. HMAC is computed client-side and the key is never transmitted.

What encoding is used for the key?

UTF-8 by default. Adjust the encoding on your server to match if needed.

Does it match OpenSSL output?

Yes. `openssl dgst -md5 -hmac <key>` produces the same digest.

Related tools

Upgrade from HMAC-MD5 to modern HMAC variants or explore plain hashes. You can also browse the full Cryptography & Hashing category for more options.

MD5 Hash

Generate MD5 cryptographic hash

HMAC Generator

Generate HMAC authentication codes

Text Checksum Generator

Generate MD5, SHA-1, SHA-256, SHA-384, SHA-512, or SHA3 checksums from pasted text, perfect for quick integrity checks and deduplication.

HMAC-SHA224 Generator

Generate a keyed SHA-224 HMAC fingerprint for compact message authentication in embedded and IoT systems.

HMAC-SHA1 Generator

Generate an HMAC-SHA1 code to sign webhook payloads, AWS-style requests, or legacy API authentication schemes.

HMAC-SHA256 Generator

Generate an HMAC-SHA256 code for signing JWTs, webhook payloads, API requests, and OAuth tokens.

HMAC-SHA3 Generator

Generate an HMAC-SHA3 keyed-hash authentication code using the Keccak family for modern cryptographic workflows.

HMAC-SHA384 Generator

Generate an HMAC-SHA384 code for enterprise-grade message authentication and PCI-friendly signatures.

HMAC-SHA512 Generator

Generate an HMAC-SHA512 code for high-entropy signatures on large payloads and long-lived tokens.

NTLM Hash

Generate NTLM password hash

CRC16 Hash

Generate CRC-16 checksum

CRC32 Hash

Generate CRC-32 checksum