HMAC Signature Generator🔒 100% local
Sign payloads with HMAC-SHA256. Privacy-first, no server uploads, no tracking.
Related Tools
Computes an HMAC-SHA256 signature for a secret and a message. Enter them as secret, message or secret | message; the first separator splits the pair, and the tool prints the digest as hex and as base64url plus the equivalent one-liners for Node, Python and OpenSSL. The SHA-256 implementation is plain JavaScript inside the page, so the key stays in your tab - worth a thought before pasting a live production secret anywhere.
How to use it
- Type the key, then a comma or a pipe, then the message: secret, message.
- Press Process.
- Compare the hex digest with the signature the sender computed, or copy the Python or Node line as a template for your own code.
Worked example
secret, messagebecomes=== HMAC-SHA256 ===
Secret: secret
Message: message
Hex: 8b5f48702995c1598c573db1e21866a9b825d4a794d169d7060a03605796360b
Base64url: i19IcCmVwVmMVz2x4hhmqbgl1KeU0WnXBgoDYFeWNgs
Node.js: crypto.createHmac('sha256', secret).update(msg).digest('hex')
Python: hmac.new(secret.encode(), msg.encode(), hashlib.sha256).hexdigest()
curl: echo -n "message" | openssl dgst -sha256 -hmac "secret"
Use case: webhook payload signing (Stripe, GitHub, Slack verify with this exact algorithm).Checked with an independent implementation: HMAC-SHA256 keyed with the UTF-8 bytes of "secret" over the message "message" gives 8b5f4870...360b, and the base64url form is that digest with the padding removed.
key123 | hellobecomesHex: a3287ee176a6e0195d01db8dd666e7bdaebd10c003c0661b967f4da58a1410ba
Base64url: oyh-4Xam4BldAduN1mbnva69EMADwGYbln9NpYoUELoThe pipe form, so key123 is the key and hello is the message. Only the digest lines are shown here; the tool also echoes the secret and message and prints the same Node, Python and curl templates.
When to use it
- A webhook receiver keeps rejecting your signature and you want to see what the digest should be for the exact body you sent.
- You are porting a signing routine between languages and want a known-good pair of hex and base64url values to test against.
- Generating a signature for a documented example request or a test fixture.
What it does not do
- Only SHA-256. A SHA-1 or SHA-512 signature cannot be reproduced here, and the key is read as literal UTF-8 text, so a secret stored as base64 or hex has to be decoded before you paste it.
- The split is on the first separator only, so a key that itself contains a comma or a pipe is cut short at that character.
- It signs exactly the characters you paste. Line endings, a trailing newline or JSON formatting differences change the digest, and that mismatch is the usual reason a locally computed signature does not equal the one the server received.