Base64 does not support url_safe codec, resulting in inconsistencies with the backend example: secret key = "u-rXsMB_aegAnzC_CJt27plLGNqOfR2EHI5o2ro1NOI"; message = "https://github.com/"; var hash = CryptoJS.HmacSHA256(message, baseKey); var hashInBase64 = CryptoJS.enc.Base64.stringify(hash); Expect the results: KkcD0POQJ50q-NsUoOwsrrc8140TYEtfiQBCwbf0u04 The actual results: KkcD0POQJ50q+NsUoOwsrrc8140TYEtfiQBCwbf0u04=