HMAC Generator
Compute HMAC-SHA signatures in the browser for webhook secrets and API signing. Paste a message and a key, pick SHA-1 through SHA-512, and copy hex or Base64. Keys stay in the tab.
Runs in your browser. Nothing is uploaded.
Hex
-
Base64
-
About this tool
Compute HMAC with Web Crypto: SHA-1, SHA-256, SHA-384, or SHA-512. Paste a message and a secret, then copy hex or Base64. Typical use is checking a webhook signature or minting a test header without sending the key to a hosted HMAC site.
How to use: type the secret, paste the payload, pick an algorithm. Empty secrets are rejected. Output is the raw HMAC, not an HTTP header wrapper like sha256=...
Example: signing {"id":1} with webhook-secret and SHA-256 yields a 64-character hex digest you can compare to a provider's test vector. SHA-1 is offered for compatibility, not for new designs.
Keys and messages stay in the tab. Related: hash generator if you needed a digest without a key, JWT decoder if the signature was a token. After load, signing works offline.
Related Crypto tools
Hash Generator
Generate cryptographic hashes (SHA-256, SHA-1, MD5, and more) from text using Web Crypto in your browser. Create checksums for files-as-text, compare digests, and copy hex output. Hashing never leaves the tab, so test strings and secrets stay private.
JWT Decoder
Decode JSON Web Tokens locally to inspect the header, payload, and expiry claims. Paste a JWT and read Base64URL-encoded fields without verifying signatures on a remote service. Ideal for debugging auth flows while keeping tokens off the network.
AES Encrypt
Encrypt and decrypt text with AES-256-GCM in the browser. A password is stretched with PBKDF2; output is Base64(salt + IV + ciphertext). Useful for sharing a short secret over a side channel you control. Keys never leave the tab.
Secret Redactor
Redact JWTs, AWS keys, GitHub tokens, private keys, bearer tokens, and emails in pasted logs. Replacement happens in the tab.