HMAC lets two parties trust a message because it carries a signature computed from a shared secret, the mechanism behind signed webhooks and API requests. The math is a hash plus a secret, and doing it by hand is not a thing people do.
Compute HMAC-SHA-256, SHA-1, or SHA-512 of a message with a secret, using Web Crypto in the browser. Keep the secret out of the payload and out of your logs, and recompute the signature server-side to verify it.
Try it now: open the free tool, runs 100{ddff9936f8333f09603555df7bd6492034f3a4a35de784276d3cf3d66166a113} in your browser.
Bottom line: verify with the same secret, never put the secret in the message.
Your turn: use the tool free here, no signup, nothing leaves your device.
How do you use HMAC Generator?
Open the HMAC Generator in your browser (HMAC with secret and hash). Type or paste your input, adjust the options, and copy the result. Everything runs locally on your device with no account and nothing stored, so the three steps below take seconds even for confidential work.
- Paste the text you want to work with.
- Choose the transformation you need.
- Copy the result, or tweak the input to see it update live.
Try HMAC Generator free. It opens right in your browser.