ffee All tools
EN 中文 FR DE

URL Signature Generator

Signed URLs Using HMAC — computed locally in your browser.

Sign a URL with HMAC-SHA256

String that is signed:
Signature (hex):
Signed URL
The server recomputes the same HMAC over the path and query and compares it in constant time.

How to use the URL Signature Generator

  1. Enter the base URL, the query string and the shared secret.
  2. Set the signature parameter name, the expiry parameter and the validity window.
  3. Sign the URL and copy the finished link with its signature.

Features

Advertisement

More tools

Password Strength Checker Text Encrypt and Decrypt HMAC Generator Base32 Encoder Base58 Encoder Base85 Encoder XOR Cipher RSA Encrypt and Decrypt File Encryptor ROT47 Cipher Text to Binary Cipher Salt Generator

Frequently Asked Questions

Common questions about the free online url signature generator.

Build the path and query string, compute an HMAC-SHA256 over that string with your secret and append the signature as a query parameter.
This tool signs the path plus the query string, and includes the expiry parameter inside the signed data when an expiry is used.
The server rebuilds the same string from the request, recomputes the HMAC with the same secret and compares both values in constant time.
It turns a permanent link into a short lived one, so a leaked URL stops working after the validity window ends.
Any short name works as long as both sides agree, and common choices are sig, signature or token.
No. Without the secret an attacker cannot produce a valid HMAC-SHA256 value, and 256 bits is far beyond brute force.
For uploads and APIs it should, so sign the body hash as well as the path so that the payload cannot be altered.
No. A signature proves the link was issued by someone with the secret, but it does not identify the end user.
You can truncate it for readability, but keep at least 128 bits of the HMAC so that forgery stays impractical.

Last updated: October 10, 2026