Paste your message and secret key into a browser-based HMAC generator and it produces the keyed hash using an algorithm like SHA-256. The computation runs on your device with the Web Crypto API, so the secret key is never uploaded, which matters because that key is exactly what verifies webhooks and signs API requests.
An HMAC combines a message with a secret key to produce a hash that only someone holding the key could have generated. That is what lets a receiver confirm both that the message is intact and that it came from a party who knows the shared secret. Webhook providers sign their payloads this way so you can verify a request really came from them, and many APIs sign requests with an HMAC.
Because the secret key is what makes an HMAC trustworthy, computing it on a server that receives your key defeats the purpose. A client-side generator uses the browser's built-in cryptography to compute the HMAC locally, so you can check that your code produces the same signature a provider expects without exposing the key. It is ideal for debugging a failing webhook signature check.
An HMAC mixes in a secret key, so only someone with the key can produce or verify it, whereas a plain hash needs no key.
No. The HMAC is computed in your browser with the Web Crypto API, so the key stays on your device.
Common choices like SHA-256 are supported, matching what most webhook and API signing schemes use.