IconVault's HMAC Generator computes Hash-based Message Authentication Codes for any message and secret key, using your browser's Web Crypto API. Choose HMAC-SHA-256, SHA-384, SHA-512 or SHA-1, output the tag in hex or Base64, and use the built-in compare mode to check a received tag against the computed one, which is exactly how webhook signature verification works.

HMAC proves a message came from someone holding the secret key and was not altered in transit, which is why APIs use it to sign requests and webhooks. It is free with no signup and runs fully in your browser, so your key and message never leave your device. The honest caveats: SHA-1 is included only for legacy compatibility, pick SHA-256 or better for new work, and never paste a real production secret into any web tool, including this one; it is built for testing and development.