Enter a key and a message to compute the HMAC. Runs entirely in your browser — a key is a credential, so nothing here is ever sent anywhere.
ℹ️ About HMAC
HMAC combines a secret key with a hash function so the result proves both the message's integrity and that whoever produced it knows the key — used for things like signing webhook payloads and API requests.
HMAC-MD5 and HMAC-SHA-1 are still used in some legacy systems, but prefer HMAC-SHA-256 or HMAC-SHA-512 for anything new.
Runs entirely client-side — nothing you type here is ever sent anywhere. The JSON API below is a separate, opt-in endpoint for scripts.