Compute HMAC-SHA-256 and HMAC-SHA-512 signatures with your secret key — right in your browser.
HMAC (Hash-based Message Authentication Code, RFC 2104) combines a secret key with a message to produce a signature that only someone holding the same key can reproduce. It is the mechanism behind most webhook verifications — Stripe, GitHub, Shopify and Slack all sign their webhook payloads with HMAC-SHA-256 — as well as signed URLs, API request signing and session token integrity checks. When a webhook validation fails, computing the expected signature by hand with this tool is usually the fastest way to find the mismatch.
The computation uses SubtleCrypto, the browser's native WebCrypto API: the key is imported with crypto.subtle.importKey and the signature produced with crypto.subtle.sign, so the cryptography is the browser's own audited implementation rather than JavaScript reinventing it. HMAC is not simply hash(key + message): it hashes twice, mixing the key with two different paddings (see the formula below), which closes the length-extension attacks that break the naive construction. The output here reproduces the RFC 4231 test vectors exactly.
Your secret key never leaves the browser: this tool makes no network requests, uploads nothing and stores nothing — you can confirm that in the network tab of your browser's developer tools. Two practical notes for production code: always compare signatures using a constant-time comparison to avoid timing attacks, and make sure both sides sign exactly the same bytes — an invisible trailing newline or a re-serialized JSON body is the most common cause of mismatched HMACs.
HMAC(K, m) = H((K xor opad) || H((K xor ipad) || m)), where H is the hash function and ipad (byte 0x36) and opad (byte 0x5c) are repeated to the hash block size. The nested double hashing prevents the length-extension attacks that break naive hash(key + message) constructions.
It proves a message came from someone holding the secret key and was not altered in transit. Typical uses: verifying webhook payloads (Stripe, GitHub, Shopify), signing API requests and protecting URLs or cookies against tampering.
No. The key and the message are processed 100% locally by your browser's WebCrypto API — nothing is transmitted, logged or stored anywhere.
Almost always an encoding difference: a trailing newline, a re-serialized JSON body, UTF-8 versus another encoding, or hex output compared against Base64. Sign the exact same bytes with the same key and the signatures will match.
Both are considered secure. HMAC-SHA-256 is the industry default and what most webhook providers use; choose HMAC-SHA-512 when the receiving side expects a 128-character signature.
No. HMAC authenticates a message but does not hide it — anyone can still read the content. Use encryption for confidentiality and HMAC (or both, as in authenticated encryption) for integrity and authenticity.
Vai.la turns any URL into a short link with click statistics, QR Code and your own biolink.
Vai.la is not responsible for how the tools are used or for decisions made based on their results.