HMAC-SHA256 Generator
Create an HMAC-SHA256 signature from a message and a secret key. The tool encodes both as UTF-8, applies the HMAC construction from RFC 2104 with SHA-256 and returns the 256-bit tag in hex or Base64. Developers use it to debug webhook signatures from services like Stripe, GitHub or Slack, sign API requests and compare results with their own code. The key is never returned or logged.
Frequently asked questions
What is HMAC-SHA256?
HMAC-SHA256 is a message authentication code built from SHA-256 and a secret key, as defined in RFC 2104. Only someone with the key can compute the correct tag for a message. The result is 32 bytes, or 64 hex characters.
How do I verify a webhook signature?
Paste the exact raw request body as the message and your signing secret as the key, then compare the result with the signature header. Many services sign a combination, such as Stripe's timestamp, a dot and the body, so build the message the way their documentation describes. A single changed byte gives a different tag.
Is there a known test vector?
RFC 4231 test case 2 uses the key Jefe and the message what do ya want for nothing? and expects 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843. This tool returns exactly that value.
How are the key and message encoded?
Both are encoded as UTF-8 text. If your secret is given in hex or Base64, as some services do, the bytes differ from the text you see, and you need to decode the key in your own code first. Whitespace and line breaks count in both fields.
Is my secret key stored?
No. The key is used only to compute the tag during the request. It is not included in the response, not logged and not stored.
Can the key be empty or very long?
HMAC accepts keys of any length, including an empty key. Keys longer than 64 bytes are first hashed with SHA-256, as the RFC specifies. For real use, choose a random key of at least 32 bytes.
Should I choose hex or Base64?
Use the format the other side sends. GitHub and Stripe use hex, while Slack prefixes hex with v0= and many AWS and JWT based systems use Base64. Both encode the same 32 bytes.
Is HMAC-SHA256 the same as SHA-256 of the key and message joined?
No. HMAC hashes the message twice with inner and outer padded keys, which protects against length extension attacks. Concatenating key and message and hashing once gives a different, weaker result.
How should I compare signatures in my code?
Use a constant-time comparison function such as crypto.timingSafeEqual in Node.js or hmac.compare_digest in Python. A normal string comparison can leak timing information about the expected tag.
How large can the message be?
The message and key together may be up to 5 MiB of text. That covers typical webhook payloads and API requests.