What is the RFC 4231 test vector?

Key "Jefe", message "what do ya want for nothing?" → hex 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843.

Both. Stripe-style webhook checkers often want hex; some JWT or AWS flows want Base64.

Does the secret leave the tab?

No. Web Crypto signs locally. Do not paste production secrets into a shared screen.

Is HMAC a password hash?

No. Use a password KDF (Argon2, scrypt, bcrypt). HMAC authenticates a message with a key.

Runs in your browser · Last updated 7 September 2026

Free HMAC SHA256 Generator

Free HMAC-SHA-256 generator. Sign a UTF-8 message with a key — hex and Base64, Web Crypto, in this tab. Nothing is uploaded.

Secret keyMessage

HMAC-SHA-256 (hex)

…

HMAC-SHA-256 (Base64)

…

Computed with Web Crypto in this tab. The key never leaves the browser. Not a password KDF.

How to use this tool

Enter the UTF-8 secret and the message.
Copy hex or Base64.
Compare against the RFC 4231 vector if you are debugging.

Worked example

The default fields are RFC 4231 test case 2. If the hex is not 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843, something is wrong with the browser crypto path. Pair with the SHA-256 page when you do not have a key.

Frequently asked questions

What is the RFC 4231 test vector?: Key "Jefe", message "what do ya want for nothing?" → hex 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843.
Hex or Base64?: Both. Stripe-style webhook checkers often want hex; some JWT or AWS flows want Base64.
Does the secret leave the tab?: No. Web Crypto signs locally. Do not paste production secrets into a shared screen.
Is HMAC a password hash?: No. Use a password KDF (Argon2, scrypt, bcrypt). HMAC authenticates a message with a key.
Uploaded?: No.