Sec-WebSocket-Accept calculator

Paste the Sec-WebSocket-Key from the request and get the Sec-WebSocket-Accept the server must return in its 101.

Everything runs in your browser. Nothing you type and no file you open is sent to a server.

Spec: RFC 6455 § 4.2.2RFC 6455 § 1.3

How it is computed

RFC 6455 § 4.2.2, step 5.4. Three steps:

  1. 1Take the Sec-WebSocket-Key value exactly as it arrived. Do not decode it, trim it or re-encode it.
  2. 2Append the fixed GUID 258EAFA5-E914-47DA-95CA-C5AB0DC85B11 to it.
  3. 3Hash that ASCII string with SHA-1 and base64 the 20 bytes. The server sends the result in a 101 response, next to Upgrade: websocket and Connection: Upgrade.

The GUID is printed in the RFC and is the same for everyone, so this check says nothing about security. It shows one thing: the server really speaks WebSocket and did not just echo a header or replay a cached response.

Want to see more?

View in Solpuga