Micro Tools
Advertisement

HMAC-SHA256 generator

Compute HMAC-SHA256 for a message and secret key in your browser. HMAC-SHA256 is the modern standard for API signatures and webhook verification.

Input

Enter the message and the secret key. The standard for webhook signatures.

The crypto library loads from a CDN on first use, then everything runs locally. Nothing you type is uploaded.
HMAC-SHA256 tag

The authentication tag appears below in hexadecimal.

-
Advertisement

The modern default

HMAC-SHA256 is the workhorse of web security: JWT signatures (HS256), AWS Signature Version 4, GitHub and Stripe webhook signatures, and HKDF key derivation all build on it. With 256-bit tags and SHA-256's clean record, it meets current 128-bit security recommendations with margin.

How verification works

The signer and verifier share a secret. The signer sends message plus tag; the verifier recomputes HMAC-SHA256(message, secret) and compares in constant time. A match proves the message came from a key holder and was not modified in transit.

Related tools

JSON formatterFormat and validate JSON, privately. Regex testerTest regex live with highlighting. Base64 encoderBase64 encode and decode, plus URL encoder and JWT decoder.

HMAC-SHA256 FAQs

How do I verify a webhook with this?
Paste the webhook payload as the message and your webhook secret as the key, then compare the computed tag with the signature header the sender provided. They must match exactly.
What key length is best?
32 random bytes (256 bits) matches the tag size and is the recommended choice. Longer keys are hashed down; shorter keys weaken the tag.
Hex or Base64 output?
This tool outputs lowercase hex. Many APIs expect Base64 or hex; convert with a Base64 tool if your provider uses Base64 signatures.
Is HMAC-SHA256 quantum safe?
Roughly. Grover's algorithm halves its effective strength to about 128 bits, which remains acceptable. No urgent migration is needed.
Timing attacks?
When comparing tags in your own code, use a constant-time comparison to avoid leaking the tag byte by byte. This page just computes the tag.
Advertisement