API Signature Generator

What this tool does

It computes an HMAC-SHA256 signature from a message (a "string to sign") and a secret key, and outputs the result as hex or Base64 — the exact building block behind AWS Signature V4, many webhook-verification schemes, and most homegrown "sign your API requests" auth systems.

What is HMAC signing, and why does it matter?

HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function — here, SHA-256 — with a secret key so that only someone who knows the key can produce a valid signature for a given message, and anyone with the key can verify one. APIs use this to prove two things at once: that a request genuinely came from a holder of the secret key, and that its contents weren't altered in transit. Unlike plain SHA-256, hashing the message alone would let anyone recompute the same hash — the secret key is what makes it unforgeable.

The typical flow: build a canonical string from the parts of the request that matter (HTTP method, path, headers, timestamp, body — the exact recipe varies by provider), HMAC-sign that string with your API secret, then send the resulting signature alongside the request, usually in a header. The receiving server rebuilds the same canonical string, signs it with the key it has on file, and checks the two signatures match.

How to use it

1. Paste the exact string you need to sign into String to sign — this could be a raw message, or a canonical request string built per your API provider's spec (method, path, headers, timestamp, body, joined in their required order).
2. Enter your Secret key.
3. Choose Hex or Base64 for the output — check your API provider's documentation for which one it expects.
4. Copy the Signature and send it along with your request, typically in an Authorization or custom signature header.

The signature updates automatically as you type.

FAQ

Does this match AWS Signature V4 or a specific vendor's scheme exactly? This tool computes the generic HMAC-SHA256 primitive those schemes are built on, not a full vendor-specific implementation (AWS SigV4, for example, layers multiple rounds of key derivation and a very particular canonical-request format on top of HMAC-SHA256). If your provider gives you a canonical string to sign, paste that string here and the resulting HMAC will be correct; if it requires derived/nested keys (like SigV4's signing key chain), you'll need to perform those derivation steps before the final HMAC.

Why only SHA-256? SHA-256 is the hash function nearly every modern API-signing scheme standardizes on — it's a strong, well-vetted default with no known practical attacks. Older SHA-1-based schemes are being deprecated across the industry, so this tool doesn't offer them.

Hex or Base64 — which should I use? Whichever your API expects. Both encode the identical 32-byte signature; hex is twice as long but easier to eyeball, Base64 is more compact. Check your provider's documentation.

Can I use this to verify a signature I received? Yes — sign the same message with the same secret key and compare the result (character-for-character) to the signature you were given. A mismatch means either the message or the key don't match what the sender used.

Privacy

When used in the browser, everything — including your secret key — is computed locally in JavaScript and never transmitted or logged. If you call this tool through the API instead, your message and key are processed for that single request only and are not logged or stored server-side; even so, treat any API secret you paste here (browser or API) as sensitive, and avoid reusing production keys in shared or logged environments where you can avoid it.