JSON-Utils

HMAC Generator

Compute an HMAC signature for a message with your secret key, using the Web Crypto API built into your browser. Built for checking webhook signatures from services like Stripe and GitHub, and for API authentication. The key is used in memory only and is never stored or sent anywhere.

Message
HMAC (SHA-256, hex)
Signature will appear here
Ready. The sample message and key are filled in; press Generate HMAC.

Your key is used in memory by the Web Crypto API and is never stored or sent anywhere.

How to use the HMAC Generator

  1. Type or paste the message to sign, and enter the secret key shared with the service (Stripe, GitHub, or your own API).
  2. Pick the algorithm the service expects (usually SHA-256) and the output format, hex or Base64.
  3. Press Generate HMAC, then copy the signature and compare it with the one the service sent.

Example

The sample signs with the key my-secret-key, which is filled in when the page loads. The SHA-256 hex result is 03d011ee...dd6c, a stable value you can verify anywhere.

Hello, world!

Frequently asked questions

Is my secret key safe here?

The key is typed into a password field, used in memory by the Web Crypto API to sign, and never stored, logged, or sent anywhere. Signing happens entirely in your browser tab.

Why is SHA-1 marked legacy?

SHA-1 is broken as a collision resistant hash, and HMAC-SHA1 survives only because HMAC relies on different properties. It is offered for verifying signatures from older systems; new integrations should use SHA-256 or stronger.