HMAC Generator

HMAC is a message authentication code built on top of a hash function. It combines a secret key with the message through two hash passes and specific padding, producing a signature only someone who knows the key can generate. Unlike a plain hash, which anyone can recompute, an HMAC proves two things at once: that the message has not been altered and that it came from someone holding the key.

It is the standard authentication mechanism in exchange APIs. Binance, Kraken, Coinbase, Bybit and practically everyone else require you to sign every private request: you concatenate the parameters, the timestamp and sometimes the path, compute HMAC-SHA-256 with your secret key, and send the result in a header. The server repeats the computation with its copy of the key and compares. If they match, the request is authentic.

The detail that makes the construction secure is that the key never travels. Only the signature does, and it does not let anyone derive the key. This also means the timestamp matters: without it, someone intercepting a signed request could replay it indefinitely. That is why exchanges reject signatures with stale timestamps.

On using this page specifically: the signature is computed with the Web Crypto API and no network request is made, but the sensible advice is still not to paste an API key with trading permissions here. Use test keys, or read-only keys, while debugging an integration. And if you have ever pasted a real key into any online tool, revoke it: rotating a key is cheaper than working out afterwards who had it.