Hashing
HMAC-SHA256 generator
HMAC-SHA256 signs a message with a secret key and returns a 64-character lowercase hex tag that anyone holding the same key can recompute. API clients rely on it for request signing (AWS Signature Version 4 and Stripe webhook verification both build on HMAC-SHA256), and an HS256 JWT is exactly this construction. Paste the message into the Input box and the shared secret into the Key box; the tag appears the moment both have content.
How to use HMAC-SHA256
- Open HMAC-SHA256 in the Toolbox101 app.
- Paste the message or payload you want to sign into the
Inputbox. - Type the shared secret into the
Keybox. If the key is hex or Base64 rather than plain text, setKey isto match. - Leave
OutputonHex, or pickBase64if the service you are signing for expects that. - Copy the 64-character tag from the
Outputbox.
Worked example
HMAC-SHA256 returns the output below for this combination.
Input
The quick brown fox jumps over the lazy dogKey
keyOutput
f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8Check it yourself: open HMAC-SHA256 and enter the same input and key.
Frequently asked questions
What do developers use HMAC-SHA256 for?
HMAC verifies both the integrity and the authenticity of a message between parties that share a secret key. Webhook providers such as Stripe sign payloads with HMAC-SHA256 so you can reject forged requests, AWS Signature Version 4 signs API calls with it, and HS256 JWTs are HMAC-SHA256 tags over the token header and payload.
What goes in the Input box and the Key box?
The Input box holds the exact message you are signing: a request body, a webhook payload, a raw string. The Key box holds the shared secret, and Key is says how to read it: as plain UTF-8 text, as hex, or as Base64, for keys that come as encoded bytes. Changing a single character of the message or the key changes the whole tag, which is how tampering shows up. A signing secret is real credential material, so use a throwaway key for tests where you can.
Can I check a webhook signature with this?
Yes, if you know exactly what the provider signs. Stripe signs the timestamp, a dot and the raw payload (timestamp.payload), so build that string first. GitHub signs the raw body and sends the tag as sha256=<hex>, so compare against the hex after the prefix. Paste the exact bytes you received: reformatting the JSON changes the tag.
Why is an HMAC-SHA256 tag always 64 characters?
The tag is a 256-bit value, or 32 bytes, and hex writes each byte as two characters, so the hex output is always 64 characters whatever the message or key length (Base64 output is 44). It is not the plain SHA-256 digest of the message: the key changes the result.