HesapHanem

HMAC-SHA256 Generator

Enter a message and secret key to compute its HMAC-SHA256.

How it is calculated

The tool computes HMAC-SHA256(key, message). Internally the key is padded to the 64-byte block size (or first hashed if it is longer), XORed with two constants, and used in two nested SHA-256 hashes. The result is 32 bytes, shown as 64 lowercase hexadecimal characters and again as base64. Text and key are both required; if either is empty the tool returns nothing. Both are treated as plain UTF-8 text exactly as typed, so a space, a line break or different capitalization changes the output. The key is a text string, not hex: typing 0a1b uses those four characters, not two bytes. The same input always gives the same result.

Worked example

Message: The quick brown fox jumps over the lazy dog; key: key. The tool returns the 64-character hex tag f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8. The same 32 bytes in base64 are 97yD9DBThCSxMpjmqm+xQ+9NWaFJRhdZl0edvC0aPNg=. If you change "dog" to "cog" or the key to "Key", the output becomes completely different, which is how a receiver detects tampering.

Try this example →

Common mistakes

  • Adding a trailing space or newline to the message or key, which silently produces a different tag from the one the server calculates.
  • Entering a hex or base64 key and expecting it to be decoded first; this tool uses the characters as typed, so a binary key needs to be handled in code.
  • Comparing the hex output with a base64 signature (or the other way round) without noticing the format difference.
  • Using HMAC as encryption; the tag only proves authenticity and integrity, and the message itself is not hidden.
  • Pasting a real production secret into a web page; use a test key when you only need to check your implementation.

Sources

About this calculator

HMAC-SHA256 is a keyed-hash message authentication code defined in RFC 2104: it combines a secret key with the message through two nested SHA-256 hash operations (HMAC(K,m) = H((K⊕opad) ∥ H((K⊕ipad) ∥ m))) so that only someone holding the key can produce a valid tag, and any change to the message or key produces a completely different output. Unlike a plain hash, HMAC is specifically designed to resist length-extension attacks.

This generator takes a message and secret key and computes the HMAC-SHA256 tag in both hexadecimal and base64. API developers use it constantly to sign and verify webhook payloads, generate AWS-style request signatures, build JWT HS256 tokens, and confirm that a message wasn't tampered with in transit — since the same key and message will always reproduce the same tag, letting the receiving side recompute and compare it.

Was this helpful?

You can pick up to 3 reactions.

Comments (1)

  • Editorial team

    When your tag does not match the server's, compare the exact bytes before suspecting the algorithm. A single trailing newline changes the whole tag, and so does typing the key as hex when the server decoded it to bytes first. This page treats both fields as the text you typed. A good check is the well-known test pair of key and the fox sentence. Which service or webhook signature are you trying to reproduce?

Popular calculators

Loan Calculator

Monthly payment, total interest and full amortization schedule.

Percentage Calculator

Percent change, percent of, and ratio calculations.

Discount Calculator

Calculate final price, savings, and discount amount.

BMI Calculator

Body mass index from height and weight (metric or imperial).

Age Calculator

Compute your exact age in years, months and days from a birth date.

Compound Interest Calculator

Calculate the final amount and interest earned with compounding.

All Calculators