Create HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512 digests from a message and shared secret entirely in your browser via Web Crypto. Copy hex or Base64 for webhooks, tickets, or local scripts — nothing is uploaded. HMAC authenticates with a key; it is not encryption and not a password-storage scheme.
Yes. Signing runs in your browser with the Web Crypto API. ConvertWiseHub does not receive your message or secret.
A plain hash (Hash Generator) fingerprints data without a key. HMAC requires a shared secret so only parties who know the key can produce a matching code — common for API webhook signatures. For file integrity without a key, use our File Checksum Verifier.
Both encode the same digest bytes. Hex is common in docs and checksum lists; Base64 is shorter and often used in headers or JSON. Match whatever the receiving system expects. Need to encode/decode Base64 payloads separately? Use our Base64 Encoder & Decoder under Developer tools.
HMAC is not Argon2 or bcrypt. Do not store login passwords as HMACs and call it done. Use a proper server-side password-hashing scheme. For generating random passwords, use our Secure Password & Passphrase Generator.
HMAC-SHA-256 is the usual default for APIs and webhooks. Choose 384 or 512 when a protocol or partner requires a longer digest. Longer is not automatically “more secure” for every threat model — follow the spec you are implementing.
No. The secret stays in your browser session. Avoid pasting production secrets on shared or public screens.