Signing flow
HMAC combines message + shared secret using hash algorithm to create tamper-detection signatures.
Generate HMAC signatures (SHA-1, SHA-256, SHA-512) for API and webhook testing.
Updated
Quick start
Set message, secret and algorithm to create signature.
Paste payload and secret key.
Choose SHA-1, SHA-256 or SHA-512.
Copy resulting hex digest.
In-depth guide
Generate HMAC signatures for webhook testing, signed URLs, and API request authentication flows.
HMAC combines message + shared secret using hash algorithm to create tamper-detection signatures.
Store shared secrets securely and rotate periodically for production systems.
Use this tool for quick browser-based work when you need an answer or output immediately. Use a dedicated application or automated workflow when you need bulk processing, approvals, or repeatable production rules.
Browser-first by design. The tool page explains any exception before you use it.
Your input is handled in the browser wherever the tool can process it locally. EpitomeTool does not add an upload step unless a tool page explicitly says so.
SHA-1, SHA-256, and SHA-512.
Yes, same message + same secret + same algorithm yields same digest.
Yes, done via browser WebCrypto.
Keep exploring
Hand-picked utilities that pair well with the one you're on — all free, client-side, and zero-signup.
Encrypt and decrypt text locally with AES-256-GCM and passphrase-derived keys.
Generate signed HS256 JWTs from custom header and payload JSON locally.
Generate 6-digit rolling TOTP codes and otpauth URIs from Base32 secrets.
Shrink PDF file size without uploading to a server.
Body Mass Index with metric / imperial inputs and WHO category bands.
Combine multiple PDFs into one in your browser.
Split a PDF by pages or page ranges, download as zip.