HMAC-SHA256 generator
Computes an HMAC per RFC 2104 with SHA-256, the scheme payment providers and webhook platforms use to sign requests.
Loading the tool…
Processing and privacy: The result is calculated inside your browser and your data is not sent to any server.
How to use it
- Enter secret key, key type, message and message type.
- The result appears straight away and updates as you edit.
- Copy the result, or copy a link that keeps the same values to share it.
How it is calculated
HMAC = SHA256((K XOR opad) || SHA256((K XOR ipad) || message)), where the key K is zero-padded to 64 bytes (hashed first if longer), ipad = 0x36 and opad = 0x5c.
Example
Inputs: Secret key = Jefe, Key type = Text (UTF-8), Message type = Text (UTF-8). Result: HMAC-SHA256 (hex): 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843; Key length: 4 bytes; Message size: 28 bytes.
Jefe
5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843
Limits and caveats
- The calculation stays in your browser, but avoid pasting live production keys on any device you do not trust.
- Many webhook platforms sign the raw request body, so any extra space or reordered field changes the signature.
Questions about this tool
How is HMAC different from plain SHA-256?
Anyone can compute SHA-256, but HMAC needs the secret key, so only someone holding it can produce the right signature.
Why does my signature not match the platform?
Check the key encoding (text, hex or Base64), that the message is the exact raw body, and whether you compare hex or Base64.
Can the key be longer than 64 bytes?
Yes, a longer key is hashed with SHA-256 first as RFC 2104 specifies, and the tool does that automatically.