HMAC-SHA256 Generator
Generate an HMAC-SHA256 code from a message and secret key, right in your browser.
Helpful?
Thank You!
Thanks for your feedback!
Already Rated
You have already rated this tool.
Message
Secret Key
Options
HMAC Output
HMAC-SHA256
0 characters
0 bits
All Algorithms
| Algorithm | HMAC Value | Actions |
|---|---|---|
| SHA-256 | ||
| SHA-384 | ||
| SHA-512 | ||
| SHA-1 |
About HMAC: Hash-based Message Authentication Code (HMAC) combines a secret key with a hash function
to create a unique authentication code. It's commonly used for API authentication, data integrity verification,
and secure message transmission.
HMAC-SHA256 is the most widely used HMAC variant — it powers Stripe and GitHub webhook signatures, AWS request signing, and JWTs signed with HS256. This tool computes HMAC-SHA256 from your message and secret key locally in your browser.
How to use it
- Paste your message — the exact text being signed.
- Enter your secret key as text, hex, or Base64.
- Read the HMAC-SHA256 digest as hex, Base64, or Base64URL.
Worked example
The message Hello, World! with key my-secret-key yields a 64-character hex digest (256 bits). The same message and key always produce the same code, so a receiver who shares the key can confirm that nothing was altered in transit.
HMAC-SHA256 in code
// Node.js
const crypto = require('crypto');
crypto.createHmac('sha256', 'my-secret-key')
.update('Hello, World!')
.digest('hex');
# Python
import hmac, hashlib
hmac.new(b'my-secret-key', b'Hello, World!', hashlib.sha256).hexdigest()Need SHA-1, SHA-384 or SHA-512 too? Use the full HMAC generator, or read how HMAC works.
Frequently Asked Questions
HMAC-SHA256 is a message authentication code built from the SHA-256 hash function and a secret key. It produces a 256-bit (64 hex character) code used to verify that a message is authentic and unmodified.
Provide the message and the shared secret key; the tool applies HMAC with SHA-256 and returns the digest. In code, use
crypto.createHmac('sha256', key) in Node.js or hmac.new(key, msg, hashlib.sha256) in Python.
SHA-256 is a plain hash anyone can compute. HMAC-SHA256 also mixes in a secret key, so only parties holding the key can create or verify the code — it proves authenticity, not just integrity.
No. The HMAC-SHA256 code is computed in your browser with the Web Crypto API. Your message and secret key never leave your device.