HMAC Generator
Compute an HMAC signature over any message with a shared secret. HMAC is how webhook providers and signed APIs prove a request really came from them -- and reproducing the signature locally is the fastest way to debug a failing verification.
The secret and payload are processed locally with the Web Crypto API and cleared when you press Clear or leave the page. Nothing is transmitted or stored.
How HMAC verification works
- The sender computes HMAC(secret, raw body) and puts it in a header such as X-Signature.
- The receiver recomputes the HMAC over the exact raw bytes received and compares the two values.
- Always compare with a constant-time function (for example timingSafeEqual) to avoid timing side channels.
- Sign the raw body, not a re-serialised object -- re-encoding JSON changes the bytes and breaks the signature.
Security note
Never paste a production signing secret into a tool you do not trust. This page runs entirely in your browser, but the safest habit is to test with a staging secret.
Related tools
UUID & Token Generator
Generate cryptographically random UUID v4 values and hex/Base64 API tokens.
TOTP 2FA Code Generator
Turn a Base32 secret into live six-digit authenticator codes to test MFA enrolment.
Password Strength Checker
Analyse password length, character variety and weak patterns locally in your browser.