The payload arrived, but did it really come from you?
When two systems exchange data, anyone who can reach the channel can quietly alter it. A checksum tells you the bytes changed; it does not tell you who changed them. For that you need a keyed tag — a value only someone holding the shared secret could have produced.
Tag it with HMAC
Paste the message and the secret into the HMAC Generator and pick SHA-256, SHA-384, or SHA-512. The tool returns a tag computed with the Web Crypto API. Send the tag alongside the message; the receiver recomputes it with the same secret and compares. A match means the content is intact and came from a holder of the key.
HMAC is not the same as a plain hash
A plain Hash Generator (MD5/SHA) is public: anyone can compute it, so it cannot prove authorship. HMAC mixes the secret in, which is what makes it a signature rather than a fingerprint. Use HMAC when authenticity matters; use a plain hash when you only need a quick integrity check or a cache key.
Where it earns its keep
- Verifying webhook bodies between a provider and your server.
- Signing tokens or challenge responses in a lightweight protocol.
- Confirming a config blob was authored by your own tooling, not edited in transit.
All computation is local, so the secret never leaves the page you compute it on.