Cryptography

HMAC Generator

Compute an HMAC signature over any message with a shared secret. HMAC is how webhook providers and signed APIs prove a request really came from them -- and reproducing the signature locally is the fastest way to debug a failing verification.

The secret and payload are processed locally with the Web Crypto API and cleared when you press Clear or leave the page. Nothing is transmitted or stored.

How HMAC verification works

  • The sender computes HMAC(secret, raw body) and puts it in a header such as X-Signature.
  • The receiver recomputes the HMAC over the exact raw bytes received and compares the two values.
  • Always compare with a constant-time function (for example timingSafeEqual) to avoid timing side channels.
  • Sign the raw body, not a re-serialised object -- re-encoding JSON changes the bytes and breaks the signature.

Security note

Never paste a production signing secret into a tool you do not trust. This page runs entirely in your browser, but the safest habit is to test with a staging secret.