HMAC-SHA1 Generator — Legacy Signing & Verification Online

What is HMAC-SHA1?

HMAC-SHA1 was the standard signing algorithm of the pre-2015 web. OAuth 1.0 (Twitter API v1, Trello, older Yahoo APIs), AWS S3 signature v2, and countless enterprise SSO / SAML integrations rely on it. The 2017 SHAttered attack broke SHA-1's collision resistance, but HMAC's security proof depends only on the underlying hash being a pseudorandom function — a property SHA-1 still has. So HMAC-SHA1 remains cryptographically fit for message authentication, and there is no active push to remove it from production systems that already use it. For any new API, use HMAC-SHA256.

How to compute or verify HMAC-SHA1 online

1. 1Paste the exact message bytes to sign.
2. 2Enter the shared secret.
3. 3Get the signature in hex (40 chars), base64 (28 chars), or base64url.
4. 4To verify an incoming request, paste its signature into the Verify field.

Use Cases

Key Concepts

Why HMAC-SHA1 is still safe

HMAC's security reduces to the hash being a pseudorandom function, not to collision resistance. SHA-1 is broken for collisions but still a PRF, so HMAC-SHA1 is safe for authentication.

Tips & Best Practices

• ▸Don't confuse SHA-1's broken collision resistance with HMAC-SHA1's message-authentication security. They rely on different properties.
• ▸For any brand-new API you design, use HMAC-SHA256 — it's the modern default and no vendor requires HMAC-SHA1 anymore.
• ▸Constant-time comparison rules apply just like HMAC-SHA256.
• ▸40-char hex vs 28-char base64 — vendors pick one or the other. Our Verify field accepts both.