HMAC Generator (Calculate HMAC-SHA256 in Browser)
An HMAC calculation tool to generate HMAC SHA256 right here. Keys and inputs are neither sent nor stored.
Supports Text/Hex/Base64 inputs and Hex/Base64 outputs. Securely calculates using the browser's standard Crypto API.
Input and Output
This page performs calculations entirely within the browser and does not send data.
* The 'byte sequence' as per API specifications is important. If the key is binary, please enter it in Hex/Base64.
Options
Results will change if newline codes differ due to OS or copy-pasting.
Since API signatures assume 'exact match', keeping as is is generally recommended.
Usage
The basic 3 steps for creating an HMAC signature.
- 1 Enter Key (Select Hex / Base64 if API spec is binary)
- 2 Enter Message (String to sign / payload)
- 3 Select Output Format (Hex / Base64) and Copy
HMAC is calculated on 'byte sequences', not 'character strings'. Even if they look the same, results will differ if character encoding, newlines, or extra whitespace differ (assumes UTF-8).
Examples (Test Vectors for Verification)
Click 'Load Example' to populate the input fields.
Common Pitfalls
Results change if newline handling varies.
Since signatures assume exact matches, removing whitespace may cause mismatches.
Base64URL typically uses +→-, /→_, and omits =. Please check the specifications.
Example: Entering 'deadbeef' as a 'string' vs entering it as 'byte sequence 0xDE 0xAD...'.
Supplementary Information
A mechanism to create a signature from a secret key and a message. A third party cannot create the same result without the same key.
SHA-256 is a 'hash', HMAC is a 'keyed hash (signature)'.
Used for API signatures, Webhook verification, request tampering detection, etc.
FAQ
Is the key stored?
It is not stored. This tool calculates within the browser and does not send keys or messages to a server. (※As a precaution, please reset after inputting on a shared PC)
Base64 or Hex?
Both are used. You can select the output format (Hex / Base64 / Base64URL). Please choose according to the API specifications.
Character Encoding?
Assumes UTF-8. Text input is converted to bytes as UTF-8 for calculation. Use Hex / Base64 input for handling binary.
Difference between HMAC and SHA-256 hash?
SHA-256 is a 'hash', HMAC is a 'keyed hash (signature)'. The same result cannot be produced unless the keys match.
The output doesn't match
Common causes are (1) Key handling (Text vs Binary), (2) Newlines, (3) Whitespace, (4) Base64URL. Please check the pitfalls above in order.