HMAC Generator

The HMAC Generator produces a keyed hash signature from a message and secret key using a chosen algorithm, computed locally with the Web Crypto API. It is for developers signing requests, verifying webhooks, or building message-authentication checks.

HMAC proves a message came from someone holding the shared key and was not altered. Computing it locally keeps the secret key in your browser rather than sending it to a server.

1. Enter the message you want to sign.
2. Provide the secret key.
3. Choose the hash algorithm, such as SHA-256.
4. Generate the HMAC signature.
5. Copy the signature for your request or comparison.

• Keyed HMAC over a chosen hash algorithm
• Web Crypto API computation
• Message and key input
• Runs entirely in the browser — HMAC

• Signing API requests that require an HMAC header
• Verifying a webhook signature against its payload
• Generating a message-authentication code for testing
• Checking that an HMAC implementation matches expected output

• Use a long, random secret key and keep it out of source control.
• Match the exact algorithm and message encoding the receiving system expects.
• On the server, compare HMACs with a constant-time function to avoid timing attacks.

• Reusing a weak or guessable secret key, which undermines the whole signature.
• Comparing signatures with a plain equality check in code, which can leak timing; use a constant-time comparison server-side.
• Signing the wrong representation of the message, such as before rather than after encoding.