Compute HMAC-SHA1 from a message and shared secret key. Although SHA-1 is deprecated for collision resistance, HMAC-SHA1 still appears in legacy APIs and documentation examples.
How it works
HMAC nests SHA-1 with your secret to produce a 40-character hex digest. The key never leaves your browser in this demo tool—processing is entirely client-side via crypto-js.
Common use cases
- Maintaining older integrations that still specify HMAC-SHA1
- Comparing against sample code in legacy OAuth 1.0a documentation
- Contrasting digest length with HMAC-SHA256 on the same inputs
Limitations
Do not use HMAC-SHA1 for new security designs—prefer HMAC-SHA256. Never paste production secrets into browser tools. Output is hex without 0x prefix.
Example
Different messages or keys produce entirely different 160-bit digests rendered as 40 hex characters.