HMAC-SHA1 Generator — Legacy Signing & Verification Online
Compute HMAC-SHA1 signatures with any secret key. Outputs hex, base64, and base64url. Still used by OAuth 1.0, AWS S3 signature v2, and some older webhook schemes. 100% local via Web Crypto API.
Last updated:
CommentsCompute HMAC-SHA1 signatures (160 bits, 40 hex chars) for legacy interop — OAuth 1.0, AWS S3 signature v2, and older webhook schemes. HMAC-SHA1 remains cryptographically safe for message authentication; SHA-1's collision weakness doesn't compromise HMAC. Runs 100% locally.
The secret never leaves your browser — HMAC runs locally via Web Crypto API.
(enter a message and secret)(enter a message and secret)(enter a message and secret)Need a different HMAC algorithm?
What is HMAC-SHA1?
HMAC-SHA1 was the standard signing algorithm of the pre-2015 web. OAuth 1.0 (Twitter API v1, Trello, older Yahoo APIs), AWS S3 signature v2, and countless enterprise SSO / SAML integrations rely on it. The 2017 SHAttered attack broke SHA-1's collision resistance, but HMAC's security proof depends only on the underlying hash being a pseudorandom function — a property SHA-1 still has. So HMAC-SHA1 remains cryptographically fit for message authentication, and there is no active push to remove it from production systems that already use it. For any new API, use HMAC-SHA256.
How to compute or verify HMAC-SHA1 online
- 1Paste the exact message bytes to sign.
- 2Enter the shared secret.
- 3Get the signature in hex (40 chars), base64 (28 chars), or base64url.
- 4To verify an incoming request, paste its signature into the Verify field.
Use Cases
Sign OAuth 1.0 requests
OAuth 1.0 base strings are HMAC-SHA1-signed with the composite key (consumer_secret + '&' + token_secret). Debug your base string here before hitting a legacy API.
Debug AWS S3 v2 signatures
S3 signature v2 uses HMAC-SHA1 over the canonicalized request. v4 uses HMAC-SHA256, but many legacy tools and buckets are still on v2.
Verify legacy webhook signatures
Older webhook providers still send HMAC-SHA1 signatures in an X-Signature header. Verify authenticity before processing.
Key Concepts
- Why HMAC-SHA1 is still safe
- HMAC's security reduces to the hash being a pseudorandom function, not to collision resistance. SHA-1 is broken for collisions but still a PRF, so HMAC-SHA1 is safe for authentication.
Tips & Best Practices
- ▸Don't confuse SHA-1's broken collision resistance with HMAC-SHA1's message-authentication security. They rely on different properties.
- ▸For any brand-new API you design, use HMAC-SHA256 — it's the modern default and no vendor requires HMAC-SHA1 anymore.
- ▸Constant-time comparison rules apply just like HMAC-SHA256.
- ▸40-char hex vs 28-char base64 — vendors pick one or the other. Our Verify field accepts both.
Frequently Asked Questions
Is HMAC-SHA1 still safe?
Yes for authentication — HMAC's security proof depends on the underlying hash being a PRF, and SHA-1 hasn't been broken in that sense (only collision resistance has). It's still fine to keep HMAC-SHA1 in production for legacy interop. For new systems, use HMAC-SHA256.
What still uses HMAC-SHA1 in 2026?
OAuth 1.0 signatures (some legacy Twitter / Trello APIs), AWS S3 signature v2 (v4 is HMAC-SHA256), older Basecamp / Xero webhooks, and various legacy enterprise SSO integrations.
How long is an HMAC-SHA1 signature?
160 bits — 40 hex chars, or 28 characters in base64 (with padding).
Should I migrate off HMAC-SHA1?
For any new API you design: yes, use HMAC-SHA256. For existing integrations: if the counterparty forces HMAC-SHA1, it's still cryptographically safe. Just document the choice as legacy interop.
Is my secret sent anywhere?
No. Everything runs locally in your browser.
Try Next
AES Encrypt / Decrypt
Encrypt and decrypt text with AES (128 / 192 / 256, GCM authenticated or CBC legacy) using a password. PBKDF2 key derivation with 200,000 iterations. 100% local — the Web Crypto API runs entirely in your browser.
Related Tools
JWT Decoder
Decode JSON Web Tokens (JWT) to inspect the header, payload, and signature. Runs entirely in your browser — tokens are never sent to any server.
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes of any text online. Free, no signup — all hashing runs entirely in your browser via the Web Crypto API, so nothing is uploaded.
HMAC Generator
Compute HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512 online. Verify API requests, sign webhooks, and authenticate messages. Free, no signup — signing runs locally via the Web Crypto API, secrets never leave your browser.
JWT Verifier
Paste a JWT and its signing key (HMAC secret, RSA/EC public key in PEM or JWK) to verify the signature and inspect claims. Supports HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512. Also flags exp / nbf / iat time-based claims. 100% local — nothing is sent to any server.
JWT Generator
Create signed JSON Web Tokens with HS256/384/512 (HMAC), RS256/384/512 (RSA), PS256/384/512 (RSA-PSS), or ES256/384/512 (ECDSA). Paste a raw secret, a PEM private key, or a JWK — signing runs entirely in your browser via the Web Crypto API.
HMAC-SHA256
Compute HMAC-SHA256 signatures with any secret key. Outputs hex, base64, and base64url encodings. Verify a signature against an expected value in one click. Used by AWS SigV4, JWT HS256, Stripe / GitHub / Slack webhooks. 100% local via Web Crypto API.