Skip to main content

Authorized use only. Use this tool solely on systems, tokens, and assets you own or are explicitly permitted to test — credential extraction, signature forging, and unauthorized access are prohibited by our Acceptable Use Policy.

HMAC Generator

Generate HMAC

Continue with

TLS Certificate Checker

Check TLS/SSL certificate expiry, issuer, and security configuration. Paste openssl output for instant analysis.

Prompt Injection Tester

Scan prompts and untrusted content for injection patterns: overrides, exfiltration commands, hidden Unicode, encoded payloads. Includes attack payloads and the Lethal Trifecta checklist.

OWASP ZAP Report Analyzer

Paste an OWASP ZAP JSON or Markdown scan report and get a triaged summary: risk counts, affected URLs, CWE links and fix guidance. 100% client-side.

About the HMAC Generator

HMAC (Hash-based Message Authentication Code) verifies both the integrity and authenticity of a message. APIs use HMAC signatures to ensure requests came from an authorized source and were not tampered with in transit.

Generate HMAC signatures using SHA-256, SHA-384, or SHA-512. Paste your message and secret key — the HMAC is computed instantly in your browser. Common use cases include Stripe webhook verification, AWS API signing, and JWT HS256 tokens.

How to use

  1. Paste the message you want to sign.
  2. Enter your secret key.
  3. Select the hash algorithm (SHA-256 is most common).
  4. Copy the HMAC signature for your API request or verification.

Frequently Asked Questions

How is HMAC different from a hash? ▾

A hash (like SHA-256) only verifies data integrity — anyone can compute it. HMAC requires a secret key, so it verifies both integrity AND authenticity — only someone with the key could have produced the signature.

Where is HMAC used? ▾

Stripe webhook signatures (hex-encoded HMAC-SHA256), AWS API request signing (SigV4), JWT HS256 tokens, and GitHub webhook payloads all use HMAC.