HMAC Generator
Compute an HMAC signature for a message and secret key, via the Web Crypto API. Runs entirely in your browser.
[ SECRET ]
[ MESSAGE ]
[ HMAC-SHA-256 ]
// waiting for input
About HMAC Generator
An HMAC proves that a message was produced by someone holding a shared secret and was not altered in transit. It is what most webhook providers use to sign their payloads.
How to use it
- Paste the message.
- Enter the shared secret key.
- Pick the hash function — SHA-256 is the common choice.
- Copy the resulting HMAC and compare it to the one you received.
Frequently asked questions
- How is HMAC different from a plain hash?
- A plain hash of a message can be recomputed by anyone. An HMAC also requires the secret key, so it authenticates the sender as well as the content.
- Which hash should I use?
- Match whatever the other side uses. SHA-256 is the most common; check the provider's documentation.
- Is my secret sent anywhere?
- No. The HMAC is computed locally with the Web Crypto API.