HMAC Calculator

Generate and Verify HMAC Signatures — Locally

HMAC (Hash-based Message Authentication Code) is what Stripe, GitHub, Twilio, Slack, and most webhook systems use to prove that a payload really came from them and wasn't tampered with in transit. CipherForces HMAC Calculator computes and verifies HMAC signatures entirely in your browser, with two dedicated modes built around real debugging workflows — not generic "hash some text" output.

Generate Mode

Paste the message body, paste or type the secret key, pick the algorithm (SHA-1, SHA-256, SHA-384, SHA-512), and get the signature in both hex and base64. Key input accepts UTF-8 text, hex, or base64 — common formats used by different vendors. Useful when you're generating a signed request to send to an API that expects HMAC auth, or when you're building the verification logic on the receiving side and need a known-good signature to test against.

Verify Mode

Paste the message body, paste the secret, paste the signature you received, and the tool returns a clear ✓ match or ✗ no-match indicator. This is the killer feature for webhook debugging — when Stripe sends you a Stripe-Signature header and your server says "invalid signature," you can drop the raw body, your endpoint secret, and the header value into this tool and find out within a second whether the bug is in your signature comparison or in your body parsing (the most common cause: invisible whitespace or JSON re-stringification mangling the body).

Common Use Cases

• Webhook signature verification: Stripe, GitHub, Twilio, Slack, Shopify, Vercel, Linear — all use HMAC-SHA256 over the raw request body with a shared secret.
• Build a known-good test: When implementing webhook auth on your server, generate a signature with this tool and unit-test against it.
• Debug "invalid signature" errors: Compare what your server computes against what the vendor sent — instantly see whether the body or the secret is the problem.
• API request signing: AWS Signature v4, OAuth 1.0a, and many internal APIs use HMAC over a canonical request string.

Privacy

HMAC computation uses the browser's native crypto.subtle API. Your message body and secret key never leave your device. Compare that to "free" online HMAC tools that log every payload + secret you paste — handing them production webhook secrets is exactly what you don't want to do when debugging.