HMAC Signature Generator & Message Digest Verifier
Hash-based Message Authentication Code • SHA-256 / SHA-512 / SHA-1
🛡️ 100% Client-Side Air-Gapped Privacy
All cryptographic computations run strictly inside your browser Web Crypto runtime. No keys or plaintexts ever leave your machine.
⚡ Hardware-Accelerated Web Crypto API
Leverages native C++ and hardware AES-NI / SHA instructions through browser APIs for zero-latency throughput.
Frequently Asked Questions & Security Specifications
What is an HMAC and how does it prevent tampering?
An HMAC (Hash-based Message Authentication Code) binds cryptographic hashing (such as SHA-256) with a secret key. Anyone without the key cannot recreate or alter the valid digest, guaranteeing message integrity and origin authentication.
Why is HMAC preferred over plain MD5 or SHA-256 for APIs?
Plain hashing (e.g. `hash(secret + message)`) is vulnerable to length extension attacks. HMAC structures inner and outer hash pads (`ipad` and `opad`) mathematically proven to eliminate length extension exploits.
Which algorithm should I choose for modern webhooks?
HMAC-SHA256 is the gold standard used by GitHub, Stripe, Shopify, and AWS SigV4. HMAC-SHA512 is recommended when dealing with 64-bit architectures requiring higher collision margins.