Question 1

What is HMAC used for?

Accepted Answer

HMAC (Hash-based Message Authentication Code) verifies both data integrity and authenticity. It is used in API signing (AWS, GitHub webhooks), JWT tokens, TOTP/2FA and request verification.

Question 2

Which SHA algorithm should I use?

Accepted Answer

SHA-256 is the modern default and is recommended for new projects. SHA-1 is still used by some legacy systems (TOTP, JWT HS256). SHA-512 is stronger but produces longer output.

Question 3

How should I encode the secret key?

Accepted Answer

Most APIs (AWS, Stripe, GitHub) expect the key as UTF-8 text. Some (TOTP) use Base32. Use the Key encoding dropdown to tell the tool how to interpret your key and message.

Question 4

Is my secret key sent anywhere?

Accepted Answer

No. All HMAC computation runs in your browser via the Web Crypto API. Your secret key and message never leave your device.