Message
exact input bytesNo upload. Newline normalization is applied only when you explicitly select it.
Secret key
WaitingUse a randomly generated secret and store it outside source code.
Algorithm—
Message bytes—
Key bytes—
Tag bytes—
Message fingerprint—
Key fingerprint—
Exact byte inspector
Message hex preview—
Key hex preview—
Output size—
Why this is safer than a generic hash box
Byte-explicitYou control encodings and line-ending normalization.
Uses Web CryptoHMAC is performed by the browser cryptography implementation.
Timestamp + payload composer
Many webhook systems authenticate an exact string such as timestamp.payload. Build it visibly before signing—never assume the separator or field order.
Exact signing string
Characters0
UTF-8 bytes0
This composer is protocol-neutral. Always follow the exact signing-string rules documented by your webhook provider.
Python
PHP
OpenSSL CLI
HMAC is not encryption
HMAC authenticates a message with a shared secret. Anyone with the secret can create valid tags, so secret management matters.
Compare exact bytes
Different Unicode encodings, whitespace, JSON formatting, or newline conventions produce different HMAC values. The byte inspector makes those differences visible.
Key length
For new random secrets, RFC 2104 recommends at least the hash output length: 32 bytes for SHA-256, 48 for SHA-384, and 64 for SHA-512.
Privacy
The tool makes no network requests and does not store your message or secret. Reloading the page clears the working state.