Calculate AWS Signature Version 4 for API requests with step-by-step signing process visualization.
This tool walks a single AWS API request through the four stages of the Signature Version 4 process from AWS's General Reference: build a canonical request from the method, URI, query string, headers, and a SHA-256 payload hash; hash that canonical request; derive a signing key by chaining HMAC-SHA256 over the date stamp, region, service name, and the literal 'aws4_request'; then use that key to produce the final hex signature and Authorization header. The mistake people hit most is canonical URI encoding: S3 canonical URIs are URI-encoded exactly once, while almost every other AWS service expects the path segments URI-encoded twice, and mixing the two up produces a signature that computes cleanly but AWS still rejects with SignatureDoesNotMatch.
The tool normalizes your HTTP method, URI path, and query string, lowercases and alphabetically sorts headers into the canonical header block, records which header names are signed, and computes a SHA-256 hex digest of the request body (or substitutes UNSIGNED-PAYLOAD if you opt out of body hashing). These five components are newline-joined into the canonical request that every later step hashes or references.
Starting from the string 'AWS4' concatenated with your secret access key, the tool runs four nested HMAC-SHA256 operations keyed successively by the date, the region, the service name, and 'aws4_request' to derive a request-scoped signing key. That key then HMACs the string-to-sign, which itself embeds the hashed canonical request and credential scope, producing the hex signature placed in the Authorization header.
Yes - SigV4 itself is identical across AWS services; you just need to supply the correct service identifier (e.g. dynamodb, execute-api) and region in the credential scope. The one thing to double check per service is whether it expects double URI-encoding, since S3 is the documented exception.
Yes, but you must include the session token as an x-amz-security-token header and add it to the signed headers set, otherwise AWS will reject the request even if the signature over the other headers is correct.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Format, validate, and beautify JSON with syntax highlighting and error detection.
Encode text or files to Base64 and decode Base64 strings back to their original form.
Format and indent SQL queries for better readability across all major dialects.
Convert HTML markup into clean Markdown syntax with support for tables and lists.
Write Markdown and see the rendered HTML output in real time with live preview.
Visualize unified diffs and patch files with color-coded additions and deletions.