hash_hmac function takes binary input, i.e. strings made of raw bytes. Character encoding should not come into play at all.
For example, if you were to use SHA256 to compute the HMAC key, from a password, you'd do something like this:
// second parameter selects raw bytes or ASCII hex for output (false = hex, true = raw)
$hmac_key = hash("sha256", $password, true);
// last parameter is, again, whether or not to output raw bytes
echo hash_hmac("sha256", $data, $hmac_key, false);
Assuming the password is "polynomial", the
$hmac_key variable should be:
Note that this is a hex representation of the contents of the variable - in reality it'll contain raw bytes. Now let's assume that our message is "Hello there!". The result is as follows:
(the above was generated by QuickHash)
HMAC schemes require that the key length is equal to the block size of the hash. Some implementations use a hash algorithm to produce the correct size if the input it larger or smaller than the block size. Usually the hash algorithm used is the non-HMAC version of whatever you're using. I'm unsure as to whether PHP does this, and (if they do) what method they use.