Data Integrity Playground
Sign sample JSON with HMAC-SHA256, change the data, and verify what tamper detection can and cannot tell you.
First time here?Quick start & guided walkthrough
Sign sample JSON, change it, and observe exactly what a message authentication code protects.
- Use sample dataStart with the sample JSON and demonstration secret. Object keys are sorted recursively; array order and string values remain significant.
- Create a signatureSign data to calculate an HMAC-SHA256 value. This authenticates the data for parties sharing the secret; it does not encrypt or hide the JSON.
- Test a modificationVerify the original, then change a field and verify again without signing. The signature should no longer match. Restore the sample or sign the changed data to start a new experiment.
Use invented sample data and sample secrets. HMAC authenticates data; it does not encrypt it. Object keys are sorted recursively before signing. Array order and string contents remain significant. This is a documented local serialization scheme, not a claim to implement every external canonicalization standard.
Load an example or enter your own input to begin.
How to use this tool
Enter invented JSON and a sample secret, then sign the data. Change a value and verify the original signature with the same secret. Try restoring the value or changing the secret to understand the result.
Generate a sample secret locally if desired. Export contains the canonical data, signature, and verification result, with the secret omitted. Nothing is saved automatically.
How it works
Keys in JSON objects are sorted recursively using JavaScript string ordering. Arrays preserve their order. The resulting JSON is UTF-8 encoded and signed with HMAC-SHA256 using Web Crypto.
Verification uses the same canonicalization and the supplied secret/signature. A mismatch does not identify whether the data, signature, or secret changed.
Scope and limitations
- HMAC provides integrity and shared-secret authentication, not confidentiality, freshness, or user authorization.
- This serialization is defined for this demonstration; it does not claim full compatibility with RFC 8785. Duplicate JSON object keys follow JSON.parse behavior; use unique keys.
- Unsafe large integer values are rejected: represent them as strings. Do not use production secrets or sensitive records.
Technical references
Your input stays in this tab. These tools do not upload, store, or send it to an AI service.