AWS SigV4 Signature Generator

AWS SigV4 Signature Generator

When AWS answers SignatureDoesNotMatch, the error body only carries the final hash, so you cannot tell which intermediate value drifted. This tool rebuilds every step of Signature Version 4 (AWS4-HMAC-SHA256) in order: canonical URI, canonical query string, signed headers, payload hash, canonical request, string to sign, the kDate → kRegion → kService → kSigning key chain, and finally the signature.

Enter the method, host, path, query, headers, and body you intend to send, plus your region and service. Choose whether the signature travels in an Authorization header or in the query string as a presigned URL with an expiry, pick how the body hash is computed, and press the button. An equivalent curl command is generated for pasting into a terminal, though nothing is ever sent.

Signatures are verified against the official AWS signing test suite, so you can also paste a known signature to check whether your own signer agrees. Query parameters are sorted after encoding, which is the step hand-written signers most often get wrong. Everything runs in your browser via Web Crypto, and credentials, session tokens, and request bodies are never stored.