HMAC Generator

—

—

How to use it

1. Paste the message and enter the secret key.
2. Pick a hash algorithm: SHA-1, SHA-256, SHA-384 or SHA-512 (SHA-256 is the usual choice for webhook verification).
3. Click Generate — both the HEX and Base64 forms appear immediately.
4. Copy whichever form your platform expects; webhook providers differ.
5. Use Sample first if you want to verify the output against a known test vector.

Common use cases

• Webhook signatures — compute the signature your provider documents (Stripe-style v1= payloads, GitHub x-hub-signature-256 and similar) before wiring up verification.
• API request signing — confirm your client code produces the same signature as the spec expects.
• Teaching and debugging — see how one flipped byte changes the whole signature.

Why it stays private

Signing runs through the browser's own WebCrypto (crypto.subtle). The key and message are encoded in memory, signed locally and never transmitted — the page makes no network requests.

FAQ

Q: Is this safe for production secrets? A: The computation is local, but pasting long-lived production keys into any web page is a habit to avoid. Prefer a CLI for real secrets; this tool is for verification and testing.

Q: Which output format should I use? A: Whatever the verifying side documents — GitHub uses lowercase HEX, many webhook systems use Base64. The tool gives you both.

Q: Why include SHA-1? A: Legacy systems still require it. For new designs pick SHA-256 or stronger; the descriptions in each tool flag this where relevant.