HMAC-SHA256 Generator

About this calculator

HMAC-SHA256 is a keyed-hash message authentication code defined in RFC 2104: it combines a secret key with the message through two nested SHA-256 hash operations (HMAC(K,m) = H((K⊕opad) ∥ H((K⊕ipad) ∥ m))) so that only someone holding the key can produce a valid tag, and any change to the message or key produces a completely different output. Unlike a plain hash, HMAC is specifically designed to resist length-extension attacks.

This generator takes a message and secret key and computes the HMAC-SHA256 tag in both hexadecimal and base64. API developers use it constantly to sign and verify webhook payloads, generate AWS-style request signatures, build JWT HS256 tokens, and confirm that a message wasn't tampered with in transit — since the same key and message will always reproduce the same tag, letting the receiving side recompute and compare it.