HMAC and keys
HMAC, RSA/ECDSA keys and secrets
Everything is computed in your browser with the Web Crypto API: secrets and keys are neither stored nor sent.
HMAC
Enter a message and a secret key.
About this tool
This tool brings together three tasks that come up when integrating a webhook or a signed API. The HMAC tab signs a message with HMAC-SHA-1, SHA-256, SHA-384 or SHA-512, output in hex and Base64, using a key entered as UTF-8 text, hex or Base64. It can also verify a signature you received, such as the one in a webhook header.
The Random secret tab produces an API key or signing secret of 1 to 1024 bytes (or characters for alphanumeric), in hex, Base64, Base64URL or alphanumeric, along with its entropy in bits. The Key pair tab generates an RSA-OAEP or RSA-PSS pair of 2048, 3072 or 4096 bits, or ECDSA on the P-256, P-384 and P-521 curves, exported as PEM (SPKI / PKCS#8) or JWK.
How to use it
- Pick the "HMAC", "Random secret" or "Key pair" tab.
- For an HMAC, enter the "Message" and the "Secret key", then choose the "Key encoding" and the "Algorithm".
- To check a signature you received, paste it into "Expected value (verification)" and read the result above the HMAC.
- For a secret, set the length and the "Format", then click "Generate a secret".
- For keys, choose the "Algorithm", the key size or "Curve" and the "Export format", then click "Generate the key pair".
Frequently asked questions
How do I verify a webhook's HMAC signature?
Paste the exact request body into "Message", the webhook secret into "Secret key" and the received signature into "Expected value". It is accepted in hex or Base64, and the browser performs the comparison in constant time.
What is the difference between RSA-OAEP, RSA-PSS and ECDSA?
RSA-OAEP is for encryption, while RSA-PSS and ECDSA are for signatures. RSA keys use SHA-256 and a public exponent of 65537. ECDSA gives much shorter keys for comparable security; a 4096-bit RSA key can take a few seconds to generate.
Which export format should I choose?
PEM gives an SPKI public key and a PKCS#8 private key, the format expected by OpenSSL, Node.js and most servers. JWK gives JSON, handy for a JOSE library or a JWKS endpoint. Each key can be copied or downloaded as a file.
Do my secrets and keys leave my browser?
No. Everything is computed with your browser's Web Crypto API, with no network call. Messages, secrets and keys are not saved, so the private key is gone once you leave the page. Only settings such as the chosen algorithm are remembered.