crypto_hmac
Sign and verify webhooks, API requests, or JWT tokens by generating an HMAC with a shared secret key using various hash algorithms.
Instructions
HMAC Generator (Keyed Hash). Compute an HMAC over a message using a secret key, authenticating both the content and its origin. Supports MD5, SHA-1, SHA-2 (sha224/256/384/512), SHA-3 (sha3-224/256/384/512), and RIPEMD-160; the key is read as text, hex, or base64 and the digest is returned as hex, base64, base64url, or 0x-prefixed binary. Use this when a shared secret must be involved (signing webhooks, API requests, JWT HS* signatures); use crypto_hash instead for an unkeyed digest with no secret. Runs locally on the input you provide and is rate-limited; the message and key are processed in-memory, never persisted, and never written to logs. Returns the HMAC plus hex/base64/base64url renderings and its bit length.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | The message to authenticate. Interpreted as UTF-8 text. | |
| key | Yes | The secret key. Decoded per keyFormat (text/hex/base64); never stored or logged. | |
| algorithm | No | HMAC hash algorithm. Defaults to sha256. | sha256 |
| keyFormat | No | How to decode the key string into bytes: UTF-8 text, hex, or base64. | text |
| outputFormat | No | Encoding of the returned hmac field. binary yields a 0x-prefixed hex string. | hex |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| algorithm | No | The algorithm id used (e.g. sha256). | |
| algorithmName | No | Human-readable algorithm name (e.g. SHA256). | |
| text | No | The input message, echoed back. | |
| key | No | The input key, echoed back. | |
| hmac | No | The HMAC encoded per outputFormat. | |
| outputFormat | No | The output encoding that was applied. | |
| length | No | HMAC length in bits. | |
| formats | No | The HMAC pre-rendered in every text encoding. |