Generate an HMAC (SHA-256/384/512) from a message and secret key online, computed in your browser.
Compute a keyed HMAC over a message using SHA-256, SHA-384 or SHA-512 and a secret key. HMACs prove a message came from someone who knows the key — the basis of webhook signatures and API request signing.
A hash anyone can compute; an HMAC also requires the secret key, so it both verifies integrity and authenticates the sender.
Stripe, GitHub and most webhook providers sign payloads with HMAC-SHA256 so you can confirm the request really came from them.