HMAC Generator
Generate HMAC signatures with the Web Crypto API — nothing is sent to a server
Frequently asked questions
Related guides
Encryption Tools Explained: AES vs BCrypt vs HMAC
Three cryptographic primitives developers constantly confuse — reversible encryption (AES), password hashing (BCrypt), and message signing (HMAC). What each one is for, and how to pick correctly.
JSON Web Tokens (JWT) Explained: A Complete Guide for Developers
What a JWT is, how the header.payload.signature structure works, which claims matter, and how to sign and verify tokens securely — with examples you can run in your browser.
Generating Secure API Tokens and Secrets in the Browser
How to create cryptographically strong tokens, sign payloads with HMAC, and encrypt data with AES — all client-side, with nothing sent to a server.
Related tools
AES Encryption
Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.
Basic Auth Generator
Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.
Bcrypt Generator & Verifier
Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.
BIP39 Mnemonic Generator
Generate and validate BIP39 seed phrases locally for testing
Checksum Calculator
Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API
CORS Header Validator
Validate Cross-Origin Resource Sharing headers for security compliance