HMAC Generator & Verifier

An HMAC (Hash-based Message Authentication Code) is a keyed cryptographic construction that combines a secret key with a message through a hash function such as SHA-256. Unlike a plain hash, which anyone can recompute from the message alone, an HMAC can only be reproduced by someone who holds the same secret key — that is what makes it an authentication code rather than just a checksum.

This is the fundamental difference from a plain digest: our own Hash Generator tool computes unkeyed hashes like MD5 or SHA-256, which are great for detecting accidental corruption but prove nothing about who produced the data, since anyone can generate the same hash. An HMAC proves both integrity (the message was not altered) and authenticity (the signer knew the shared secret), which is why HMAC is the standard building block behind API request signing, JWT's HS256/HS384/HS512 algorithms, and TLS record authentication.

The most common real-world use case is verifying webhook signatures. Services like Stripe, GitHub, and Shopify sign every webhook payload with HMAC-SHA256 using a secret you configure, and send the resulting signature in a request header. Your server is expected to recompute the HMAC over the raw payload with the same secret and compare it against the header value — if they match, you know the request genuinely came from that service and was not tampered with in transit. This tool's verify mode reproduces exactly that check: paste the payload, the shared secret, and the received signature, and get an instant match or mismatch.

Everything runs locally through the browser's native Web Crypto API (crypto.subtle.importKey and crypto.subtle.sign), so the secret key, message body, and resulting signature never leave your machine — nothing is uploaded to any server, which matters since HMAC secrets are exactly the kind of value you should never paste into a random online tool that could log it.