What this tool does
HMAC combines a secret key with a hash to authenticate a message. It is used by webhooks, signed URLs and API authentication. This tool signs text with the Web Crypto API and never sends the secret anywhere.
How to use it
- Paste the message.
- Enter the secret and choose an algorithm.
- Copy the hex or Base64 signature.
Questions
How is HMAC different from a hash?
A plain hash only proves integrity. HMAC also requires a secret key, so it proves the message was signed by someone who knows the key.
Which output should I use?
Use hex for logs and documentation, Base64 for HTTP headers and compact transport.
Is the secret stored?
No. It stays in the page memory and disappears when you close or reload the tab.