Loading your tools...
Loading your tools...
Generate keyed signatures for API authentication and webhook verification.
The secret key is used to sign the message.
All computations happen directly in your browser. Your message and secret key never leave your device.
Supports standard algorithms like SHA-256 (standard for JWTs) and legacy MD5 for compatibility.
Enter the payload/message exactly as it is sent in your integration.
Enter the shared secret key used by your service.
Select the hash algorithm and output format.
Generate and compare the signature with your application output.
Webhook signature verification
API request signing tests
Integration debugging for auth mismatches
Cross-language cryptographic parity checks
HMAC combines a secret key with a hash function to verify message authenticity and integrity. It is widely used in webhooks and signed API request flows.
Correct canonicalization matters: whitespace, encoding, and line breaks can change signatures even when content appears visually identical.
When signatures do not match, first verify payload canonicalization and encoding before rotating keys or changing algorithms.