Compute an HMAC-SHA256 signature in hex and Base64
Runs in your browser. Nothing you type is sent anywhere. Updated on 24 Oct 2026.HMAC-SHA256 is the signature most APIs ask for: AWS request signing, Razorpay and Stripe webhooks, JWTs signed with HS256 and countless internal services. Type or paste the secret and the message and the 64-character hex digest appears as you type, with the Base64 form beside it. Keys can be plain text, hex or Base64, and the whole calculation runs in your browser.
The page opens with SHA-256 already selected under Algorithm.
Type the shared secret into Secret key, and set Text, Hex or Base64 to match how your API gives it.
Paste the exact string or request body to sign into Message; a line break at the end changes the result.
Copy the 64-character Hex digest, or the Base64 form if the API header expects that.
This HMAC generator computes a keyed hash of text or a file with SHA-1, SHA-256, SHA-384 or SHA-512 and shows the result in hex, Base64 and URL-safe Base64 as you type. It also verifies: paste the signature you expect and it tells you whether it matches.
HMAC is how two systems prove a message came from someone holding a shared secret and was not changed on the way. Developers reach for it when a payment provider's webhook fails verification and they need to know whether the secret, the body or the header is wrong, when writing a signing function and checking it against a known answer, or when an API document shows an example signature to reproduce.
The key can be typed as text, hex or Base64, because providers publish secrets in all three. The expected signature can be hex or Base64 and may keep its header prefix, such as sha256= from GitHub or the t=,v1= format from Stripe. Comparison runs in constant time, the way your server should do it too.
The rest of the article, and all 6 questions about HMAC Generator, are on the HMAC Generator page.
Choose SHA-256, type or paste the secret key, then type the message or pick a file. The signature appears immediately in hex and Base64; press Copy next to the one your API expects. If your key is given as hex or Base64 rather than text, switch the key format first, because the same characters decode to different bytes.
Usually the body is not byte-for-byte what the sender signed: a framework parsed and re-serialised the JSON, changed line endings or trimmed whitespace. Sign the raw body. Other causes are using the wrong secret (test and live keys differ), treating a hex secret as text, or comparing hex against a Base64 signature.
A plain hash can be computed by anyone, so it proves nothing about who made it. HMAC mixes in a secret key, so only someone with the key can produce the right value. It is also built to resist length-extension attacks that break the naive approach of hashing the key followed by the message.
Text messages of any practical length and files up to 200 MB, because Web Crypto needs the whole message in memory. SHA-1, SHA-256, SHA-384 and SHA-512 are supported; MD5 is not available in Web Crypto and should not be used for new signatures anyway. Keys must be at least one byte.
Still stuck? Ask about HMAC Generator and anybody who knows can answer. No account needed.
Same job, other tools: Bcrypt Generator – Generate a bcrypt hash for a test user or a config file · OTP Generator – Time-based one-time passwords with 6 or 8 digits and a choice of algorithm.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry.
In the collection Security Tools for Developers.