HMAC Generator
Compute an HMAC to check a webhook signature or reproduce one a service expects. The secret is typed here and used here — the page is forbidden from opening a network connection at all.
Output appears here as you type.
Runs entirely in your browser. Nothing you paste here is uploaded or stored.
Questions
Am I safe pasting a real signing secret?
Judge it rather than trusting it. The computation is a pure function in page JavaScript and the page ships a Content-Security-Policy of connect-src ‘none’, so the browser blocks any request it might attempt — a restriction the page cannot lift on itself. Load it, disconnect from the network, and it still works. Every deploy is gated on an automated check that tries to exfiltrate by each available route and fails the release if any succeeds.
My webhook signature does not match. What now?
Almost always the payload rather than the key. Signatures are computed over the exact raw request body — before any JSON parse and re-serialise, which reorders keys and changes whitespace. Check for a trailing newline too, and whether the provider prefixes the signature with something like "sha256=" that has to be stripped before comparing.
Can I hash a binary file, like a downloaded release?
Not yet, and it is better to say so than to quietly return the wrong answer. Files here are read as UTF-8 text, and any byte sequence that is not valid UTF-8 is replaced during decoding — so a digest of a zip or an installer would be computed over corrupted input and would never match the published checksum. Use shasum or certutil locally for binaries until this handles bytes properly.