Generate and verify HMAC signatures locally for API requests, webhooks, signed URLs, and callback payloads. The exact bytes matter: line breaks, JSON spacing, and canonical request format must match the system that creates or checks the signature.
Use text secrets for most API dashboards, hex or Base64 when your key is provided as raw bytes, and paste an expected signature to compare without sending secrets to a server.
An HMAC combines the message with a secret key so another party holding the same key can check integrity and authenticity. It does not encrypt the message. HMAC-SHA256 is the practical default for new integrations; SHA-1 should generally be selected only when a legacy service explicitly requires it.
Confirm whether the secret is UTF-8 text, hexadecimal bytes, Base64, or Base64URL, then match the required signature output format. Verification compares the decoded signature bytes in constant time, but a successful match is meaningful only when the expected value came from a trusted source.
Related tools: Hash Generator · JWT Decoder & Verifier