HMAC generator

Keyed hashes for webhooks and API signatures — SHA-256 and SHA-512 via Web Crypto, entirely in this tab.

Privacy Nothing leaves your browser: no accounts, no uploads, and no telemetry from this page. Clear the fields when you are done on shared machines.

Secrets & timing Do not paste production signing keys on untrusted or shared devices. For verification in your own services, compare digests in constant time (for example crypto.timingSafeEqual in Node) so lengths and byte differences do not leak hints.

Not supported here This browser does not expose crypto.subtle for HMAC (often HTTP pages or very old engines). Try a current desktop browser over HTTPS or open the deployed Pablobot site.

Inputs

Algorithm Secret key Message

Try a known vector

Loads the familiar Jefe / what do ya want for nothing? pair; HMAC-SHA256 checks out against openssl dgst -sha256 -hmac 'Jefe' on the same UTF-8 bytes.

Signature

Hexadecimal

Enter a secret and message to compute HMAC.

Base64

—