Compute an HMAC signature for a message and secret key in hex or Base64, the same way most webhook and API providers do.
Runs in your browser — nothing is uploaded
An HMAC combines a message with a secret key and a hash function to produce a tag that only someone holding the key can create. Payment providers, webhook senders and many REST APIs use it to prove that a request came from them and was not altered on the way.
Pick the algorithm the provider documents. HMAC-SHA256 is the modern default, HMAC-SHA1 still appears in older integrations, and HMAC-MD5 is included for compatibility. The output is shown as lowercase hexadecimal and as Base64, because providers differ on which encoding they expect.
The message must be byte-for-byte identical to the one the provider signed. Whitespace, JSON key order and line endings all change the result, so copy the raw request body rather than a re-formatted version.
To authenticate a message. Because the tag depends on a secret key, a receiver that recomputes it can confirm that the sender knows the key and that the message was not modified in transit. An HMAC does not hide the content; the message stays readable.
The usual causes are a different message string, such as re-formatted JSON or an added trailing newline; a different encoding of the key; or the wrong output format. Compare against the provider’s test vector if one is published, and check whether they expect hex or Base64.
Yes. HMAC-SHA256 is widely trusted, and the HMAC construction stays secure even though plain MD5 and SHA-1 have known collision weaknesses. Security depends on keeping the key private and making it long enough, typically at least 32 random bytes.
Only when a legacy system requires it. Both still resist forgery within the HMAC construction, but new integrations should use HMAC-SHA256 so the choice does not have to be revisited later.
No. The key and message exist only in the page while it is open. The signature is computed in your browser with the crypto-js library, and nothing is sent to a server.
A plain hash such as SHA-256 can be recomputed by anyone who has the message, so it only detects accidental change. An HMAC also requires the secret key, so a valid tag shows that the message came from someone who holds the key.