HMAC SHA256 Generator

How to use the hmac sha256 generator

1. Enter your secret key and choose whether it is plain text or hex bytes (for example 4a656665 is the text "Jefe").
2. Type or paste the message and pick text or hex for it as well.
3. Select the algorithm: HMAC-SHA256, SHA-1, SHA-384 or SHA-512.
4. Read the hex and base64 results below. The output updates as you type.

How HMAC works

HMAC (Hash-based Message Authentication Code) combines a secret key with a message using a cryptographic hash function. The algorithm defined in RFC 2104 pads the key to the hash block size, then computes two nested hashes:

HMAC(K, m) = H((K' XOR opad) || H((K' XOR ipad) || m))

Here, K' is the key padded or hashed to exactly one block length. ipad is the byte 0x36 repeated for the full block, and opad is 0x5c repeated. For HMAC SHA256, the block size is 64 bytes and the inner hash produces 32 bytes. If the provided key exceeds 64 bytes, it is first hashed with SHA-256 to produce a 32-byte key, which is then zero-padded to 64 bytes.

RFC 4231 test vectors

RFC 4231 publishes HMAC test vectors for the SHA-2 family, and RFC 2202 does the same for SHA-1. You can reproduce any row below by choosing the matching key format, so they double as a sanity check for your own code. Keys are shown in hexadecimal.

Case 6 uses a 131-byte key, longer than the 64-byte SHA-256 block. The key is hashed first and the 32-byte digest is then zero-padded, which is the rule this tool follows.

Choosing between SHA1, SHA256, SHA384 and SHA512

The choice of hash algorithm determines both security strength and output length. SHA-1 produces a 160-bit (20-byte) digest and is no longer recommended for new systems due to known collision weaknesses, though it remains common in legacy protocols like OAuth 1.0a. SHA-256 produces a 256-bit (32-byte) digest and is the most widely used variant for HMAC today, including in JSON Web Tokens (JWTs) and webhook signatures. See the SHA256 hash generator if you need a plain hash rather than an HMAC.

SHA-384 and SHA-512 use 128-byte blocks instead of 64-byte blocks and produce 48-byte and 64-byte digests respectively. They offer higher security margins and perform better on 64-bit processors. Use HMAC SHA512 when compliance requirements or threat models demand more than 256 bits of security.

Common uses for HMAC

HMAC is used wherever two parties share a secret key and need to verify that a message has not been altered. Common applications include:

• Webhook verification: services like Stripe, GitHub and Slack sign outgoing payloads with HMAC SHA256 so receivers can confirm authenticity.
• API request signing: AWS Signature Version 4 derives signing keys through a chain of HMAC SHA256 operations.
• JSON Web Tokens: the HS256, HS384 and HS512 algorithms in JWTs are HMAC-based. Tools like the JWT decoder can inspect these tokens.
• TOTP and HOTP: time-based and counter-based one-time passwords rely on HMAC SHA1 by default. See the HOTP generator for details.

Hex versus base64 encoding

The raw output of HMAC SHA256 is a sequence of 32 bytes. To transmit or store this value as text, it must be encoded. Hexadecimal encoding represents each byte as two characters (0-9, a-f), producing a 64-character string. Base64 encoding maps every three bytes into four printable characters, yielding a shorter 44-character string (with padding). Most APIs accept either format, but webhook documentation will specify which one to use. Always compare HMAC values using constant-time comparison to prevent timing attacks.

Worked examples