HMAC Signature Calculator

📖 Overview

HMAC is a keyed message digest. It proves two things at once: that the content was not altered, and that whoever produced it actually holds the key. That is why it turns up in API signing, webhook callback verification and tamper-proof tokens. The difference from a plain hash is that knowing the algorithm and the message is not enough. You also need the key, so an attacker who edits the message cannot forge a matching signature. This tool computes HMAC through the Web Crypto interface built into the browser, supporting SHA-1, SHA-256 and SHA-512, with output as either hexadecimal or Base64, and can produce all three digests at once for comparison. Both the message and the key stay in your browser: nothing is uploaded, nothing is logged, and there is no server in the loop at all. That also means the tool keeps working offline once the page has loaded, which is worth knowing if you are debugging against a staging environment. The practical use is checking your own implementation: compute the digest here with the same key and message, then compare against what your server produced. If they differ, the cause is almost always encoding, whitespace or a trailing newline rather than the algorithm itself, so compare the raw bytes before rewriting any signing code.

✨ Features

• Three hashes: SHA-1, SHA-256 and SHA-512, either one at a time or all three together
• Output as a lowercase hexadecimal string or as standard Base64
• One input produces digests for all three algorithms, so the difference in length is obvious at a glance
• Built on native Web Crypto with no third-party crypto library pulled in, so the page stays small and there is no supply-chain question about the hashing code
• The statistics panel shows message bytes, key bytes and digest length
• Messages and keys are encoded as UTF-8 before hashing, matching what a server-side implementation does

🚀 How to use

1. Type the message you want signed into the message box
2. Enter the shared key in the key box; Chinese keys work as well
3. Choose the primary algorithm and the output format
4. Tick compute-all-three to get every digest in one pass
5. Press Calculate, then copy the value for the primary algorithm

⚠️ Notes

• HTTPS is required: Web Crypto is only available in a secure context. Opening the page over http shows a not-supported message, which is a browser restriction rather than a fault in the tool
• The key is not stored: it is cleared when the page reloads, but it does live in memory while you work, so close the tab when finished on a shared machine
• Match the encoding on both sides: most server implementations hash UTF-8 bytes, and this tool does the same. If the two disagree, check encoding before anything else
• SHA-1 is deprecated: use it only when interfacing with legacy systems. New work should use SHA-256 or SHA-512
• Empty input gives no result: leaving both message and key blank prompts you to enter something rather than returning a meaningless empty digest, and editing either field after a run invalidates the displayed digest until you press Calculate again