HMAC SHA256 Generator — Free Online Tool

Introduction

Webhook providers sign payloads with HMAC-SHA256 so receivers prove authenticity without TLS alone. When your receiver returns 401, the bug is usually encoding — UTF-8 message bytes, wrong secret, hex versus base64 output, or comparing digests case-sensitively. Command-line openssl dgst -sha256 -hmac works until you are on a machine without OpenSSL or you cannot paste production secrets into shell history.

Certoflow's HMAC SHA256 Generator imports your key as raw bytes, signs the message with Web Crypto's subtle.sign, and displays a lowercase hex digest. Both fields stay local — nothing uploads to Certoflow. Use alongside SHA-256 Generator to contrast plain hashes with keyed MACs, API Key Generator to create test secrets, and Base64URL Encoder when your API spec encodes signatures differently.

What this tool does

Field	Behavior
Secret key	Raw string interpreted as UTF-8 key material
Message	Arbitrary text signed as UTF-8 bytes
Output	64-character lowercase hex HMAC-SHA256
Compute	Runs async via Web Crypto API

Empty key or message yields no output until both are provided. The tool does not accept hex-encoded keys, file uploads, or HMAC-SHA512 — SHA-256 only.

How it works

The implementation uses standard Web Crypto HMAC:

const cryptoKey = await crypto.subtle.importKey(
  "raw",
  enc.encode(key),
  { name: "HMAC", hash: "SHA-256" },
  false,
  ["sign"],
);
const sig = await crypto.subtle.sign("HMAC", cryptoKey, enc.encode(message));

The signature bytes convert to hex with zero-padded bytes. Key and message encoding is UTF-8 via TextEncoder — matching most JavaScript and Python utf-8 defaults but potentially differing from systems that use Latin-1 key bytes.

Processing is asynchronous because subtle.sign returns a Promise. Click compute again when either input changes.

Real-world examples

Stripe-style webhook debugging

Paste the raw request body as the message and your whsec_ test secret as the key. Compare output to the Stripe-Signature header's v1 value after confirming your framework hashes the unparsed body string. Generate test secrets with API Key Generator.

Inter-service auth header

Microservices pass X-Signature: hmac(...) over canonical JSON. Minify JSON with JSON Minifier before signing if your spec requires compact serialization — whitespace changes the MAC.

AWS SigV4 learning contrast

SigV4 uses a signing key derivation chain, not a single HMAC of the body. Use this tool for simple shared-secret MACs; do not expect output to match AWS request signatures without the full algorithm.

JWT HS256 sanity check

HS256 JWTs sign header.payload with a shared secret. Decode structure with JWT Decoder, recompute MAC on the signing input, and compare to the signature segment after base64url decoding concepts from Base64URL Encoder.

Teaching MAC versus hash

Students hash a message with SHA-256 Generator then HMAC the same message with a key. Observe that knowledge of the hash does not prove authenticity without the secret key.

Common mistakes

Signing pretty-printed JSON when the sender used minified JSON. Byte-identical messages are required. Format with JSON Formatter only if both parties agree.

Using the wrong key encoding. This tool treats the key as UTF-8 text. If your system uses hex-decoded key bytes, convert first with Hex Converter.

Expecting base64 output. Output is hex. Convert if your API compares base64 MACs.

Confusing HMAC with plain SHA-256. SHA-256 of a message is deterministic and keyless. HMAC requires the secret and produces different output.

Pasting production secrets into untrusted tabs. Certoflow is local, but develop the habit of test-only secrets from Random Bytes Generator.

Case-sensitive hex comparison failures. Output is lowercase. Normalize case when comparing to uppercase digests.

Assuming empty message is invalid. Empty string is a valid message; an empty key is blocked by the UI requiring both fields.

Use cases

Backend developers verifying webhook implementations during integration.

QA engineers building expected MAC fixtures for automated tests.

Students learning authenticated encryption primitives in coursework.

DevOps staff debugging CI secrets without installing crypto CLIs on agents.

API technical writers generating verifiable examples for documentation.

Security reviewers confirming third-party SDKs use standard HMAC-SHA256.

FAQ

Is data uploaded?

No. Key and message are processed locally via Web Crypto.

What encoding is used?

UTF-8 for both key and message via TextEncoder.

Why is output hex?

Hex is universal in docs and logs. Convert externally if you need base64.

Can I use binary keys?

Enter raw bytes only if they are valid UTF-8 strings. For arbitrary binary keys, hex-encode key bytes as text or use a CLI that accepts binary.

Does this support HMAC-SHA512?

Not in this tool. Use SHA-512 Generator for hash-only needs; HMAC-SHA512 is a separate algorithm.

How does this relate to SHA-256 Generator?

SHA-256 hashes input without a key. HMAC-SHA256 combines key and message for authentication.

Can I work offline?

Yes, after page load. Web Crypto runs in the browser.

What if compute returns nothing?

Both secret key and message must be non-empty.

Is timing-safe comparison included?

No. Compare digests in your application code with crypto.timingSafeEqual when implementing verification.

What tools pair with webhook work?

JSON Validator, CORS Header Generator, and HTTP Status Code Lookup for full API debugging.