HMAC Generator

Computes a keyed HMAC signature as you type, using the browser's built-in Web Crypto API. The message and secret never leave this page.

How it works

HMAC (keyed-hash message authentication code) proves a message came from someone who knows a shared secret, and was not altered in transit — the same construction used to sign webhook payloads and API requests. Changing either the message or the secret by even one character produces a completely different signature. This tool computes it with crypto.subtle.sign, the same Web Crypto primitive browsers and Node both implement, rather than a hand-rolled HMAC.