HMAC-SHA256 Generator

Generate an HMAC-SHA256 code for signing JWTs, webhook payloads, API requests, and OAuth tokens.

Secret:

Input

Loading editor...

Output

Output will appear here...

What is HMAC-SHA256 Generator

Last reviewed: April 18, 2026

HMAC (Hash-based Message Authentication Code) combines a cryptographic hash with a secret key to verify both the integrity and authenticity of a message.

HMAC-SHA256 Generator computes an RFC 2104 HMAC using the SHA-256 hash function and a shared secret, returning a 64-character hex digest.

HMAC-SHA256 is the workhorse of modern API signing: JWTs with HS256, Stripe, GitHub, Slack, and AWS SigV4 webhooks all depend on it, so being able to reproduce a signature quickly saves a lot of time in debugging.

Why use it

Verify Stripe, GitHub, Slack, and other webhook signatures.
Sign and validate JWTs that use the HS256 algorithm.
Reproduce AWS-style request signatures and canonical headers.
Generate reference vectors during cross-language HMAC testing.
Avoid pushing debug payloads through OpenSSL for every signature check.

Features

Instant HMAC-SHA256 hex output
Matches OpenSSL, Node.js, Go, Python, and Rust implementations
Ideal for JWT HS256 and API signature debugging
Client-side signing — no upload
Handles any UTF-8 payload and key

How to use HMAC-SHA256 Generator

Paste the canonical string. Drop the exact string-to-sign into the input panel.
Enter the shared secret. Paste the secret into the Secret field, matching your peer's key byte-for-byte.
Copy the signature. The 64-character hex digest appears instantly — copy it into your Authorization header or verifier.

Example (before/after)

Message + key

message: api-request-body
key: sha256-api-key

HMAC-SHA256 hex digest

e1c92d13d9de3b6b8b1d63bff2dda61e2f6ab6b48dde0a8842c8a7ec03cdb1ef

Common errors

Using the wrong canonical string

Webhook providers specify an exact string-to-sign. Passing the raw body may not match.

Fix: Follow the provider's signing scheme precisely — see Stripe, GitHub, Slack docs.

Output format mismatch

Hex vs. base64 vs. base64url output can all represent the same HMAC differently.

Fix: Match the format your peer expects before comparing.

Trailing newlines in the payload

Copy-pasting often adds a trailing newline, changing the signature.

Fix: Trim trailing whitespace, or ensure both sides include it consistently.

FAQ

Is HMAC-SHA256 secure?

Yes. It is the de-facto standard for API request signing and considered safe for modern use.

What output length does it produce?

256 bits (64 hex characters).

Is this tool compatible with JWT HS256?

Yes. JWT HS256 signs the header.body string with HMAC-SHA256 and base64url-encodes the signature.

Does it match Node.js crypto?

Yes. `crypto.createHmac('sha256', key).update(msg).digest('hex')` returns the same output.

Is my key sent to the server?

No. The tool runs entirely in your browser.

Can I sign binary content?

This field takes UTF-8 text. Convert binary data to base64 first if needed.

Related tools

Extend the HMAC-SHA256 workflow with JWT tools, webhook verifiers, and adjacent HMAC variants. You can also browse the full Cryptography & Hashing category for more options.

JWT Decoder

Decode and view JWT token payloads

HMAC Generator

Generate HMAC authentication codes

SHA256 Hash

Generate SHA-256 cryptographic hash

HMAC-SHA1 Generator

Generate an HMAC-SHA1 code to sign webhook payloads, AWS-style requests, or legacy API authentication schemes.

HMAC-SHA384 Generator

Generate an HMAC-SHA384 code for enterprise-grade message authentication and PCI-friendly signatures.

HMAC-SHA512 Generator

Generate an HMAC-SHA512 code for high-entropy signatures on large payloads and long-lived tokens.

HMAC-MD5 Generator

Generate an HMAC-MD5 message authentication code from a plaintext message and shared secret key.

HMAC-SHA224 Generator

Generate a keyed SHA-224 HMAC fingerprint for compact message authentication in embedded and IoT systems.

HMAC-SHA3 Generator

Generate an HMAC-SHA3 keyed-hash authentication code using the Keccak family for modern cryptographic workflows.

AES Encrypt / Decrypt

Encrypt plaintext with AES and a passphrase, or decrypt CryptoJS-formatted ciphertext back to readable text, entirely in your browser.

CRC16 Hash

Generate CRC-16 checksum

CRC32 Hash

Generate CRC-32 checksum