Do I need to enter my AWS secret access key?
No. Canonicalization, credential scope, signed-header, date, expiry, host, and payload-hash checks work without it. Enter a secret only for an optional final HMAC comparison.
AWS SigV4 & S3 Presigned URL Debugger
Inspect AWS Signature Version 4 requests and S3 presigned URLs, rebuild the canonical request and string to sign, and diagnose signature mismatches locally.
Local input limit: 2 MB · Processing timeout: 8 s
Debug an AWS SigV4 request
Paste a presigned URL or complete raw HTTP request. Structural analysis does not need a secret; optional signature recomputation stays in the worker memory for this run.
Input type
Used only to recompute this signature in the disposable worker. It is never returned in the result, persisted, or included in analytics or the URL.
SigV4 analysis
Credential scope, signed headers, canonical request, string to sign, expiry checks, and optional signature comparison will appear here.
See exactly what AWS signs
The debugger reconstructs SigV4 canonical URI, sorted query parameters, normalized signed headers, payload hash, credential scope, canonical-request hash, and string to sign. Optional HMAC derivation uses the standard date → region → service → aws4_request key chain.
Verification boundaries
- Supports AWS4-HMAC-SHA256 Authorization headers and query-signed presigned URLs, including S3-style UNSIGNED-PAYLOAD requests.
- Raw requests must contain an origin-form or absolute HTTP target plus Host when needed; requests are never replayed or sent to AWS.
- A matching signature proves only that the supplied secret and reconstructed bytes produce the given HMAC. It does not establish IAM permission, credential status, bucket policy, endpoint acceptance, or trust.
- Canonicalization follows SigV4 URI and query encoding rules. Proxy rewrites, framework normalization, or bytes omitted from the pasted request can still explain a server-side mismatch.
- Secret keys remain in memory for the current worker job and are omitted from results, handoffs, URLs, analytics, and persistent storage.
Related tools for this workflow
Continue with tools that decode, convert, inspect, or verify the same data.
- API & network
Raw HTTP Request & Response Inspector
Parse raw HTTP/1.x messages, inspect framing and multipart bodies, reconstruct HTTP signature bases, compare Content-Digest, and optionally verify supplied-key signatures.
Open tool - Developer Utilities
URL Parser & Builder
Inspect URL components and query parameters, edit them, and rebuild a valid URL.
Open tool - API & network
HAR File Analyzer & Sanitizer
Analyze HAR requests, failures, timing, transfer sizes, bodies, and sensitive fields; export a separate redacted copy.
Open tool - Developer Utilities
Text Diff Checker & Code Compare
Compare two text or code inputs and inspect line and word changes locally.
Open tool
Debug a SignatureDoesNotMatch response
Paste the exact URL and request headers seen by the client, confirm the method and body, then compare the generated canonical request with the signer logs. Add the secret only when structural differences are resolved and HMAC comparison is still needed.
Input
GET /object?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=… HTTP/1.1Output
canonical URI + sorted query + signed headers + payload hash → string to signAWS SigV4 Debugger FAQ
Does a matching signature mean AWS will accept the request?
No. AWS can still reject expired or disabled credentials, missing IAM permissions, resource policies, session-token issues, endpoint rules, or other request conditions.
Why can a URL work before passing through a proxy but fail afterward?
Changing the host, path encoding, duplicate query order/value encoding, signed headers, or payload bytes changes the canonical request. Compare the exact request after every intermediary rewrite.
Are requests or credentials sent to AWS?
No. DecodeLens parses and recomputes locally in a disposable browser worker and never sends the request. Refreshing the page removes memory-only input and handoffs.