Paste the payload and your shared secret into a browser-based HMAC generator and pick a hash like SHA-256 to compute the keyed signature. It uses the Web Crypto API on your device, so the payload and secret are never sent to a server.
A webhook receiver needs to know a request really came from the expected sender and was not tampered with. HMAC solves this: the sender computes a keyed hash of the payload using a shared secret and includes it as a signature, and the receiver recomputes the same HMAC and compares. Because only the two parties know the secret, a matching signature proves authenticity and integrity.
A client-side HMAC generator lets you paste a payload and secret and get the SHA-256, SHA-384 or SHA-512 signature in your browser, so neither the payload nor the secret leaves your machine. That is useful for testing that your own signing code produces the right value. It is free and needs no account.
A matching HMAC proves the payload was not altered and came from someone holding the shared secret.
No. The HMAC is computed in your browser with the Web Crypto API, so nothing is uploaded.
Match whatever your receiver expects; SHA-256 is the most common choice.