HMAC-SHA256 Generator — Sign & Verify Webhooks and API Requests Online

What is HMAC-SHA256?

HMAC-SHA256 is the workhorse of modern web-service signing. AWS Signature Version 4 uses it. JWT's HS256 alt uses it. Stripe, GitHub, Slack, Discord, Twilio, and virtually every REST-webhook provider signs their outbound requests with HMAC-SHA256 so you can verify they're really from them. This tool computes and verifies HMAC-SHA256 signatures locally, showing the three encodings that different vendors use interchangeably (hex is most common in AWS / Stripe; base64 in JWT and some others; base64url is JWT-style). The Verify field accepts all three, so you don't need to know which encoding your vendor picked.

How to compute or verify HMAC-SHA256 online

1. 1Paste the exact message bytes you want to sign — for webhooks, this is the raw request body, not a re-serialized version.
2. 2Enter the shared secret (from the webhook config or API key management).
3. 3The tool computes the signature in hex, base64, and base64url instantly.
4. 4To verify an incoming webhook: paste its signature header into the Verify field — a green checkmark means it matches, red means it doesn't (secret wrong, body altered, or encoding mismatch).

Use Cases

Code Examples

import { createHmac } from "crypto";
const sig = createHmac("sha256", secret)
  .update(rawBody)
  .digest("hex");

import hmac, hashlib
sig = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
)
mac := hmac.New(sha256.New, []byte(secret))
mac.Write(rawBody)
sig := hex.EncodeToString(mac.Sum(nil))

Key Concepts

HMAC construction

HMAC(key, msg) = H((K ⊕ opad) ‖ H((K ⊕ ipad) ‖ msg)). The nested hash resists length-extension attacks that would break a naive H(key ‖ msg).

Base64 vs base64url

Base64 uses +, /, and = padding. Base64url replaces + with -, / with _, and drops padding. JWT signatures use base64url; most REST APIs use standard base64 or hex.

Tips & Best Practices

• ▸Sign the raw bytes of the request body — never a re-serialized JSON. Frameworks that auto-parse JSON often break signatures by dropping insignificant whitespace or reordering keys.
• ▸Use constant-time comparison (`crypto.timingSafeEqual` in Node, `hmac.compare_digest` in Python) when verifying — never `===` or `==`. Timing side-channels are real.
• ▸When comparing hex, be case-insensitive. When comparing base64, be exact (no whitespace, no padding drift).
• ▸Never log the secret. Never bake it into client-side code — HMAC-SHA256 is a server-side operation.