HMAC Generator
Generate an HMAC signature from a message and a secret key, to verify authenticity.
Proving a message hasn't been tampered with
An HMAC combines a message with a secret key to produce a signature that proves two things at once: the message has not been altered, and it came from someone who holds the key. This computes an HMAC in the common algorithms, which is exactly what webhooks and APIs use to sign requests so the receiver can confirm they are genuine.
Enter the message and the secret key, choose the algorithm, and the signature is generated.
Why HMAC and not a plain hash
A plain hash proves a message was not changed, but not who sent it — anyone can compute the hash of a message. The secret key is what adds authenticity: only someone with the key can produce the correct HMAC, so a matching signature proves the sender knew the shared secret. This is why verifying an incoming webhook means recomputing the HMAC with your key and comparing it to the signature the sender provided. Keep the key secret; the whole scheme depends on it.
HMAC Generator FAQ
How is HMAC different from a plain hash?
A plain hash proves a message was not altered; HMAC also proves it came from someone holding the secret key, adding authenticity.
What is a common use for HMAC?
Signing webhooks and API requests, so the receiver can recompute the signature with the shared key and confirm the request is genuine.
Is my key uploaded?
No. The signature is computed in your browser, so the secret stays on your machine.