Runs locally
Switch toolHMAC / Hash

JSON & structured data

JSON FormatterFormat, validate, and minify JSON with clear syntax errors.JSON CompareCompare two JSON payloads and inspect path-level changes locally.JSON SorterSort JSON object keys recursively for deterministic diffs.JSON5 FormatterFormat JSON5 configs with comments, trailing commas, and single quotes.YAML FormatterValidate and format YAML configs without uploading files.YAML to JSONConvert YAML configs into formatted JSON locally.JSON to YAMLConvert JSON objects and arrays into YAML locally.YAML to XMLConvert one-root YAML mappings into formatted XML locally.XML ToolkitFormat, validate, and convert XML to JSON locally.XML MinifierCompact XML payloads locally with parser-error feedback.XML to YAMLConvert XML attributes and repeated tags into YAML locally.JSON to XMLConvert one-root JSON objects into formatted XML locally.CSV to JSONConvert CSV header rows into JSON object arrays locally.JSON to CSVConvert JSON objects into CSV with escaped cells.CSV to YAMLConvert header-row CSV into YAML sequences locally.

Text & web

HTML FormatterFormat or compact HTML snippets with balanced-tag checks.Escape TextEscape and unescape HTML, XML, JSON, CSV, and JavaScript text.URL EncoderEncode or decode URL text and percent escapes in the browser.URL ParserParse URLs into host, path, query parameters, and fragments locally.HTML EscapeEscape or unescape HTML entities for snippets and payload examples.

Developer utilities

UUID GeneratorGenerate UUID v4/v7 values and verify pasted UUID format.Timestamp ConverterConvert seconds, milliseconds, microseconds, and nanoseconds.JWT DecoderInspect JWT headers, payloads, and registered claims locally.Mermaid EditorWrite Mermaid diagrams as code with live SVG/PNG export.

HMAC + Hash Generator

Generate SHA-256/SHA-512 hashes and HMAC signatures for API requests or webhook checks entirely in your browser.

Local processingYour input stays in this browser tab.

Message and secret

Enter a message and optional HMAC secret

Masked by default. Screen sharing, browser extensions, clipboard history, and local device access can still expose secrets.

66 message charactersNo upload

Signature output

Hash or HMAC output

Hex and Base64 output appears here.
Generate output to verify signatures
How to verify webhook signatures
Paste the exact webhook body or API message, choose the signing algorithm, enter the shared secret, and generate the HMAC. Then paste the expected signature from the request header to compare the values.
The verifier accepts raw hex, Base64, and common prefixed formats such as sha256=....
Hashing is not password storage
SHA-256 and SHA-512 are fast cryptographic hashes. They are useful for checksums and signatures, but they are not password hashing algorithms. Use Argon2id, bcrypt, or scrypt for storing user passwords.
What this HMAC / Hash does
Use this HMAC SHA256 generator, SHA256 hash generator, SHA512 hash generator, verify HMAC signature tool, and webhook signature checker for browser-local API debugging. It produces hex and Base64 outputs for SHA-256, SHA-512, HMAC SHA-256, and HMAC SHA-512.
When developers use it
  • Verify webhook signatures by hashing the exact request body with the shared secret and comparing the expected header value.
  • Generate SHA-256 or SHA-512 hashes for payload checksums, fixture verification, and integration debugging.
  • Compare raw hex, Base64, or prefixed values such as sha256=... without uploading secrets or request bodies.
Privacy, input, and output
Hashing and HMAC signing use Web Crypto locally in your browser session. PayloadHarbor does not upload the message, secret, or generated signature.
Paste the message or payload, choose hash-only or HMAC mode, select SHA-256 or SHA-512, and optionally paste an expected signature. The output shows hex and Base64 values with copy and download controls.
Validation rules and limitations
  • This tool is for API signatures, webhook checks, and checksums; SHA-256 and SHA-512 are not safe password-storage algorithms.
  • HMAC verification only confirms that the provided message, secret, and expected signature match; it does not validate timestamp freshness, replay windows, or provider-specific canonicalization rules.