HMAC SHA-256 Generator Online – Sign Messages Locally

Compute keyed HMAC-SHA256 signatures in your browser with exact input-byte encodings, without transmitting your key.

Runs locally
Ready to sign

Uses Web Crypto HMAC-SHA256 on your device. Your key and message stay in this browser session; they are not sent, logged, added to the URL or saved. Avoid using real production secrets on shared devices. Empty messages are valid; keys must contain at least one byte.

Key encoding controls how bytes are interpreted (max 65,536 characters).

Message limit: 262,144 characters. UTF-8 uses exact bytes, including spaces and line endings. Hex/Base64 modes decode input bytes before signing.

Message authentication code; not plain SHA-256, encryption or password hashing.

Keyed message authentication guide

How to generate an HMAC-SHA256 signature

An HMAC uses a secret key and a message to compute a deterministic message authentication code. This tool signs bytes using your browser's Web Crypto API without making a server request. Enter a key, select byte encodings and generate a signature you can copy. This tool is free to use. No account or payment is required.

Last updated

What you can do here

  • Browser Web Crypto HMAC-SHA256
  • Hidden secret key input
  • UTF-8, Hex and Base64 byte modes
  • Hex and Base64 signatures
  • RFC 4231 standard example
  • Copy signature
  • No secret storage or network request

How to use

  1. Enter a secret key and choose whether it is UTF-8 text, Hex bytes or standard Base64 bytes.
  2. Enter the message to sign. Empty messages are valid, but keys must be non-empty. Choose the message's exact byte encoding.
  3. Choose Hex or Base64 output; select Generate HMAC and copy the signature.
  4. Confirm that your API expects HMAC-SHA256 and the same message bytes and output encoding before comparing signatures.

HMAC versus plain SHA-256

HMAC-SHA256 incorporates a secret key, while ordinary SHA-256 computes a digest without any key. For API and webhook signatures, the exact message bytes, key encoding and output encoding must all match the other system.

HMAC authenticates a message when the shared key remains secret. It does not encrypt or hide the message, and it is not a password-hashing algorithm.

Encode keys and messages as exact bytes

UTF-8 signs the text you enter, including trailing spaces and newlines. Hex decodes each pair of digits to one byte; Base64 decodes a canonical padded Base64 string. Changing an encoding mode changes the signed bytes.

A zero-length message produces a valid HMAC, but this tool rejects empty keys. Output can be copied as lowercase hexadecimal or standard Base64.

Keep API signing secrets local

Your key and message are held in the current browser component only and are not written into URLs, browser storage, logs, analytics events or network requests by this tool. The secret key field is hidden by default.

Web Crypto requires a compatible secure browser context such as HTTPS. Avoid entering real production credentials on shared devices and clear the fields when finished.

RFC 4231 HMAC-SHA256 example

A published standard test vector; Jefe is a test key, not a real credential.

Key: Jefe; message: what do ya want for nothing?

Jefe | what do ya want for nothing?

HMAC-SHA256 Hex

5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843

Common questions

Frequently asked questions

Does this tool send my API secret to a server?

No. Web Crypto signs locally, and tool analytics receives only non-sensitive event metadata, not your key, message or signature.

Is HMAC-SHA256 the same as SHA-256?

No. HMAC includes a secret key to authenticate the message. A plain SHA-256 digest does not use a key.

Can I sign an empty message?

Yes, with a non-empty key. Empty payloads have valid HMAC signatures.

Can I sign binary keys or messages?

Yes. Choose Hex or standard Base64 input mode to decode bytes before signing. UTF-8 mode signs entered text as UTF-8 bytes.

Can I use this for password storage?

No. Use a password-specific hashing scheme such as Argon2, scrypt or bcrypt. HMAC is designed for keyed message authentication.

Recommended next steps

Hash Generator Online – SHA-256Generate ordinary unkeyed SHA-256 digests and compare encoding behavior.Base64 Encoder & Decoder OnlineExplore Base64 representation before decoding input bytes.JWT Decoder OnlineInspect JWT claims without treating decoding as signature verification.

Debugging a specific Hash issue? Browse Hash troubleshooting.