Question 1

What is the difference between HMAC and a plain hash?

Accepted Answer

A plain hash only proves integrity; anyone can compute it. HMAC mixes in a secret key, so it also proves authenticity — only parties who know the secret can produce or verify a valid signature.

Question 2

What is API testing mode?

Accepted Answer

It builds a canonical signing string from the HTTP method, request path, timestamp, and body, which mirrors how many providers construct the string they sign. This lets you reproduce and debug request signatures.

Question 3

Which algorithm should I choose?

Accepted Answer

Match whatever your API or webhook provider specifies. HMAC-SHA256 is the most common; SHA-384 and SHA-512 produce longer signatures.

Question 4

Is my secret sent anywhere?

Accepted Answer

No. The secret, message, and signature are processed entirely in your browser, and working data is cleared after you copy the result.

Generate HMAC signatures

Signature (hex)