Developer · HMAC
HMAC-SHA256 generator.
Compute an HMAC from a secret key and a message with SHA-256, SHA-1, SHA-384 or SHA-512. The key and message stay in your browser.
How to use the HMAC generator
- Type or paste text into the box, or choose a file to hash instead.
- Press the generate button and wait a moment for large files.
- Copy the value, then compare it with the checksum or signature you were given.
About HMAC
HMAC produces a keyed digest, 64 hexadecimal characters for HMAC-SHA256. An HMAC mixes a secret key into the hash (RFC 2104), so only someone holding the key can produce or verify the value. It is how many webhook providers sign requests. Use it here to reproduce a signature while debugging; the key you type never leaves the sealed frame.
Your input stays on your device
The calculation runs in your browser inside a sealed frame that cannot make network requests, so the text, file or key you enter is never uploaded. The advertising on this page sits outside the frame and cannot see what you enter.
- Line endings and trailing spaces change the result, so paste exactly what you mean to hash.
- Hashing is one-way: you cannot recover the original input from the digest.
- If a file and text are both provided, the file is hashed.
About HMAC
HMAC (RFC 2104) mixes a secret key into a hash: H((K ⊕ opad) || H((K ⊕ ipad) || message)). A key longer than the hash's block size (64 bytes for SHA-1 and SHA-256, 128 bytes for SHA-384 and SHA-512) is hashed first. Anyone with the key can recompute the value, so it proves a message came from a holder of the shared secret and was not altered.
Typical uses are webhook signatures (GitHub sends an HMAC hex digest in X-Hub-Signature-256) and JWT HS256, which is HMAC-SHA256 per RFC 7518. For JWT, choose Base64URL output and sign the exact header.payload string. Enter the key as text, or as hex when it is binary.
Known-answer examples
Use these to confirm the tool matches the standard. The Try button loads the input.
| Input | HMAC (hex) | Source | |
|---|---|---|---|
Key Jefe, message what do ya want for nothing? | 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843 | RFC 4231 test case 2 (HMAC-SHA-256) | |
Key 0b × 20 bytes (hex), message Hi There | b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7 | RFC 4231 test case 1 (HMAC-SHA-256) | |
| Same as above, HMAC-SHA-512 | 87aa7cdea5ef619d4ff0b4241a1d6cb02379f4e2ce4ec2787ad0b30545e17cdedaa833b7d6b8a702038b274eaea3f4e4be9d914eeb61f1702e696c203a126854 | RFC 4231 test case 1 (HMAC-SHA-512) |
Sources (retrieved October 2026):
Frequently asked questions
What is the difference between a hash and an HMAC?
A plain hash has no secret, so anyone can compute it. An HMAC needs the shared key, so only holders of the key can produce or verify the value.
Why does my HMAC not match the webhook signature?
Sign the raw request body bytes exactly as received, not re-serialised JSON. Check the key (text versus hex), the algorithm, and the output format: GitHub uses hex with a sha256= prefix, while many APIs use Base64.
Can the key be empty or very long?
Yes. RFC 2104 allows any key length: a key longer than the block size is hashed first, and a short key is zero-padded. Short keys are weak, though; use at least as many bytes as the hash output.
How do I generate an HS256 JWT signature?
Compute HMAC-SHA256 over base64url(header) + "." + base64url(payload) and choose Base64URL output. Do not paste real production secrets into any online tool.
Is my key sent anywhere?
No. The HMAC is computed locally with the SubtleCrypto SHA primitives. Nothing is uploaded or stored.
Keep the key secret, compare in constant time
This page runs locally, but never paste a production secret into any website you do not control; use a test key. When verifying a signature in your own code, compare with a constant-time function such as crypto.timingSafeEqual rather than ==. RFC 7518 requires an HS256 key of at least 256 bits.