Compute HMAC-SHA256 message authentication codes

Create an HMAC-SHA-256 authentication tag for a message and shared secret.

freeworks offlinenothing uploaded
ToolHMAC-SHA256
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

HMAC hashes an inner pad concatenated with the message, then hashes an outer pad concatenated with the inner digest. SHA-256 supplies the compression function and 64-byte block size; keys longer than the block are hashed first.

  • Two padded passes bind the shared secret to message bytes.

Worked example

Authenticate Message
Generate an HMAC-SHA256 signature for a message with a secret key
Input
											Input: Hello, World!
Key: MySecretKey123!
Output
												4b9c49778c4b546b324ffad7e893237c62724d27c7e1cd2548d04a19d66254ae

When to use this

API request signing, webhook checks, and shared-key protocols create HMAC tags.

Edge cases

  • Different JSON whitespace changes the tag when raw bytes are signed.
  • Comparing tags with early exit can leak timing.
  • Authentication does not hide the message contents.

References