HMAC-SHA-512: 512 Bit Tags, HS512 Tokens and Key Sizing
HMAC-SHA-512 is the widest keyed tag the generator produces: 512 bits as 128 hex characters. It is the algorithm behind HS512 signed tokens, and its inner hash uses 128 byte blocks, so keys longer than that are hashed down before use.
At a glance
- Tag size
- 512 bits
- Hex characters
- 128
- Inner hash block size
- 128 bytes. Keys longer than 128 bytes are hashed down to 64 bytes first
- Standard
- RFC 2104 and FIPS 198-1, over SHA-512 from FIPS 180-4
- Recommended key length
- At least 64 random bytes to match the tag width. More than 128 bytes adds nothing
- Safe for password storage
- No. Use a memory-hard password hash such as Argon2id, scrypt or bcrypt
- Available in the generator
- Yes, once you fill in the secret field
In detail
HMAC-SHA-512 gives a 512 bit tag from a hash that works in 64 bit words over 128 byte blocks. For short messages, which is what most tags cover, its cost is dominated by the two keyed passes rather than the message itself, so it is close in speed to HMAC-SHA-256 on 64 bit hardware and can be faster on long inputs when no SHA-256 instructions are available.
Key sizing has a hard ceiling here that people miss. HMAC pads the key to the block size, so any key over 128 bytes is first hashed to 64 bytes and then padded. A 512 byte key therefore contributes at most 64 bytes of material. Sixty four random bytes is the sensible target: it matches the tag width and sits comfortably below the point where the key gets hashed down.
Its common appearance is HS512 in signed tokens. That produces a 64 byte signature, which base64url encodes to 86 characters, and combined with a payload it makes a noticeably larger cookie or header than HS256 does. Since neither is forgeable in any reachable sense, the trade is size against nothing, and HS256 remains the reasonable default for tokens carried on every request.
There is one place the extra width genuinely helps: when the tag is being used as key material rather than as an authenticator. HKDF and similar key derivation functions are built from HMAC, and extracting 512 bits in one pass is convenient when you need to split the output into several subkeys. That is a derivation decision, not an authentication decision.
It is still not a password hash, and this is worth stating plainly because HMAC-SHA-512 turns up in homemade password schemes more than any of the others. One pass, no memory cost, no work factor: a GPU chews through it. Use Argon2id, scrypt or bcrypt, tune the cost to your hardware, and store a per-user salt. ToolBox does not offer a password hashing tool.
Examples
key: "Jefe"
data: "what do ya want for nothing?"
HMAC-SHA-512
= 164b7a7bfcf819e2e395fbe73b56e0a387bd64222e831fd610270cd7ea250554
9758bf75c05a994a6d034f65f8f0e6fdcaeab1a34d4a6b4b636e070a38bce737Shown wrapped for readability. The real tag is 128 unbroken hex characters.
key of 32 bytes -> padded to 128 bytes, all 32 bytes used
key of 128 bytes -> used as is, no padding needed
key of 200 bytes -> hashed to 64 bytes, then padded
So a 200 byte key and the SHA-512 digest of that key
produce identical tags.Things that catch people out
- An extremely long key is not a stronger key. Anything over 128 bytes is hashed down first, so the extra length is discarded before the tag is computed.
- HS512 tokens are large. A signature of 86 base64url characters on top of the payload can push a cookie past size limits that HS256 stays under, and browsers drop oversized cookies silently.
- 128 hex characters is easy to truncate by accident in a log field, a database column or a header with a length cap. A truncated tag fails verification with no useful error, so size storage to the full length.
- Do not derive a key by hashing a passphrase with SHA-512 and using the digest as the HMAC key. Use a proper key derivation function, or generate 64 random bytes and store them as a secret.
Try it: Hash Generator
Paste text or drop a file and get every digest at once, in hex or Base64, with a verify tab for comparing an expected value against what you actually have.
Hash Generator
LOCAL · Browser-OnlyGenerate MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, Keccak-256, CRC32, and HMAC hashes from text or files
MD5 is cryptographically broken and should not be used for security purposes. Use SHA-256 or SHA-512 instead.
Related Hash algorithms
All hash algorithms →HMAC-SHA-384: 384 Bit Tags and the 128 Byte Block Size
HMAC-SHA-384 gives a 96 character tag over a 128 byte block. Where JWT HS384 and TLS use it, and why the key length threshold is different.
HMAC-SHA-256: Signing and Verifying Payloads Correctly
HMAC-SHA-256 gives a 64 character authentication tag. Why it replaces hash(secret + body), how webhook signatures use it, and how verification goes wrong.
SHA-512: 512 Bit Digests and 64 Bit Word Arithmetic
SHA-512 outputs 128 hex characters using 64 bit words and 1024 bit blocks. Why it can beat SHA-256 on 64 bit hardware, and where the extra width is pointless.
CRC32: What a Checksum Detects and What It Cannot
CRC32 gives an 8 character checksum that catches accidental corruption and nothing else. Why it is trivially forgeable and never a security control.
MD5: 128 Bit Digests, Broken Collisions, and Remaining Uses
MD5 produces a 32 character hex digest. Collisions have been practical since 2004, preimages have not. What that distinction rules out, and what it does not.
SHA-1: Practical Collisions and What Replaced It
SHA-1 gives a 160 bit digest, 40 hex characters. Collisions became practical in 2017 and chosen prefix collisions in 2020. What still uses it and why.
Tools for this
- Hash Generator Free online hash generator - generate MD5, SHA-1, SHA-256 hashes from any input text
- Base64 Encoder/Decoder Base64 encode and decode online - convert text to Base64 or decode Base64 strings instantly, free