About HMAC-SHA256 Generator
This HMAC-SHA256 generator signs your text or file with a secret key. HMAC mixes the key into SHA-256 so that only someone who knows the key can produce or verify the result. It is free, needs no sign-up and runs in your browser, so nothing you enter is uploaded.
HMAC is how most APIs and webhooks prove a message is genuine. Stripe, GitHub, Shopify and many payment providers send a signature header computed as HMAC-SHA256 over the request body, using a secret you share with them. Your server recomputes it and compares. If the two match, the body was not changed in transit and came from someone holding the key.
Type the message in the text box, tick HMAC with secret key, and enter the key. The key is read as plain UTF-8 text, so a key that is shown as hex or Base64 must be decoded first or the result will not match. The result is labelled HMAC-SHA-256, and you can show it as lowercase hex, uppercase hex or Base64 (some services want the Base64 form).
HMAC follows RFC 2104. It also fixes the weakness of the naive approach of hashing the key and message joined together, which is open to length extension with SHA-256. The key and message here are never uploaded, so it is safe to try a real webhook body, but treat live production secrets with the usual care.
How to use HMAC-SHA256 Generator
- Choose an algorithm from the row of buttons: MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512 or CRC32. SHA-256 is a good default.
- Choose Text and type or paste your input, or choose File and pick a file from your device. The hash updates as you type.
- Read the digest in the result box. Tick Uppercase for capital hex letters, or Base64 output to show the digest in Base64 instead of hex.
- For a keyed hash, tick HMAC with secret key and enter the key. The result is then labelled HMAC-SHA-256 (or whichever algorithm you chose).
- To verify a download or a value from documentation, paste the expected hash into Compare with a known hash. The tool says Match or No match.
- Use Copy to put the digest on your clipboard.
Features
- Nine algorithms: MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512 and CRC32.
- Hashes text as UTF-8, so accented letters, other scripts and emoji hash the same way as on a server or in a command-line tool.
- Hashes a file you choose from your device. The file is read in your browser and never uploaded.
- HMAC with a secret key for every algorithm except CRC32, following RFC 2104.
- Hex output in lowercase or uppercase, or Base64 output.
- Compare with a known hash. Case, spaces and a leading 0x are ignored, and the expected value can be hex or Base64.
- SHA-1, SHA-256, SHA-384 and SHA-512 use the Web Crypto API in your browser, which is fast and well tested.
- A warning appears when you pick MD5, SHA-1 or CRC32, because they are not safe for security purposes.
- One-click copy of the result.
Worked examples
Key "key", message "The quick brown fox jumps over the lazy dog" gives f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
A widely published test vector.
Empty key, empty message gives b613679a0814d9ec772f95d778c35fc5ff1697c493715653c6c712144292c5ad
Choose File and pick an empty file to reproduce it, since the text box gives no result when it is empty.
Key "secret", message "Hello, World!" gives fcfaffa7fef86515c7beb6b62d779fa4ccf092f2e61c164376054271252821ff
Privacy: how it works
- The text, the file and the HMAC key stay in your browser tab. Nothing is sent to Ulkaa or to any other server, which you can confirm in the Network tab of your browser developer tools.
- Because the work happens on your own device, large files are limited by your browser memory rather than by an upload limit.
Tips
- To verify a download, choose File, pick the downloaded file, and paste the publisher hash into the compare box. A match means the bytes are identical to what the publisher hashed.
- Hash the same text twice with a trailing space added once. Seeing two unrelated digests is the quickest way to understand the avalanche effect.
- A hash you found on the same page as the download only protects against corruption. It cannot protect you if the page itself was altered.
- HMAC takes the key as plain text. If your key is hex or Base64, decode it first, or the result will not match another system.
Frequently asked questions
Is it really free?
Yes. There is no price, no trial and no credit card. Ulkaa Tool does the work with your own device, so there is no server bill to pass on to you.
Do I need an account?
No. There is no sign-up and no login. Open the page and use it. An Ulkaa account is not needed for anything on this tool.
Does it run in my browser?
Yes. Your text and files are processed by code running in your browser tab, on your own device.
Is my data uploaded?
No. Your text and files are never sent to Ulkaa or to anyone else. You can check this yourself by watching the Network tab in your browser developer tools while you use the tool.
What is HMAC-SHA256?
It is a keyed hash. It combines a secret key and a message with SHA-256 in a fixed way described in RFC 2104, giving a 256-bit signature that proves the message came from a holder of the key and was not altered.
How do I verify a webhook signature?
Compute HMAC-SHA256 of the raw request body with your signing secret, using the exact bytes you received, and compare it with the signature header. Many providers prefix the value or use Base64, so check their documentation.
Why does my HMAC not match my server?
The usual causes are a key that should be decoded from hex or Base64, a body that was re-encoded or reformatted, or a trailing newline. HMAC changes completely with any difference in key or message.
Is HMAC the same as encryption?
No. HMAC does not hide the message. It only proves who sent it and that it was not changed.
More Hash Generator pages
- Hash GeneratorHash text or a file with MD5, SHA-1, SHA-2, SHA-3 or CRC32, add an HMAC key, and check the result against a known hash.
- MD5 Hash GeneratorGet the 128-bit MD5 hash of text or a file as 32 hexadecimal characters.
- SHA-1 Hash GeneratorGet the 160-bit SHA-1 hash of text or a file as 40 hexadecimal characters.
- SHA-224 Hash GeneratorGet the 224-bit SHA-224 hash of text or a file as 56 hexadecimal characters.
- SHA-256 Hash GeneratorGet the 256-bit SHA-256 hash of text or a file as 64 hexadecimal characters.
- SHA-384 Hash GeneratorGet the 384-bit SHA-384 hash of text or a file as 96 hexadecimal characters.
- SHA-512 Hash GeneratorGet the 512-bit SHA-512 hash of text or a file as 128 hexadecimal characters.
- SHA3-256 Hash GeneratorGet the 256-bit SHA3-256 hash of text or a file as 64 hexadecimal characters.
- SHA3-512 Hash GeneratorGet the 512-bit SHA3-512 hash of text or a file as 128 hexadecimal characters.
- CRC32 Checksum CalculatorCalculate the 32-bit CRC32 checksum of text or a file as 8 hexadecimal characters.
- File Checksum CalculatorHash a file on your device and compare it with the checksum the publisher gave you.