Security

HMAC Generator

Sign messages with HMAC-SHA256/384/512 — hex and base64 signatures, keyed by your secret.

Signing runs locally via your browser's Web Crypto API. Your key and message never leave the page.

How to use

  1. Enter your secret key and pick an algorithm (HMAC-SHA256 is the common default).
  2. Paste the message or payload to sign.
  3. Click Sign and copy the signature as hex or base64.

When do I need HMAC?

An HMAC proves that a message both came from someone holding the shared secret and was not modified in transit. That is exactly what webhook providers (Stripe, GitHub, Shopify) verify on every delivery, and what you should verify on receipt. A bare hash like SHA-256 only proves integrity against accidental change — anyone can recompute it.

Need a strong secret first? Generate one with the Random Token Generator. Working with signed JWTs instead? Inspect them with the JWT Decoder.

Examples

Test webhook signatures

Reproduce the X-Signature header your webhook receiver should compute for a test payload.

Sign API requests

Generate the request signature required by custom API auth schemes.

Frequently Asked Questions

Is my secret key uploaded anywhere?+
No. The key is used only inside your browser's Web Crypto API and never leaves the page.
Which algorithm should I use?+
HMAC-SHA256 covers virtually all use cases. SHA-384/512 exist for systems that mandate longer digests.
Why are both hex and base64 shown?+
Different platforms publish signatures in different encodings — GitHub uses hex, many payment APIs use base64.
How do I verify a signature?+
Recompute the HMAC over the exact received bytes and compare in constant time; a single differing byte means rejection.

Related Tools

SecuritySecurity Analyzer

JWT Decoder & Security Analyzer

Decode JWT header and payload locally, then run security checks: weak algorithms, expiry, risky claims.

Security

Password Generator

Generate strong random passwords with crypto.getRandomValues — pick length and character sets.

Security

Random Token Generator

Generate cryptographically secure random tokens in hex, base64, or URL-safe base64.

Security

htpasswd Generator

Generate Apache/Nginx .htpasswd entries with bcrypt or {SHA} schemes — fully client-side.

Looking for something else? Browse all tools