Generate or verify HMAC signatures (SHA-1, SHA-256, SHA-384, SHA-512). Built for webhook signature debugging.
Whitespace and newlines are significant — paste the body exactly as it was transmitted.
HMAC (Hash-based Message Authentication Code) is what Stripe, GitHub, Twilio, Slack, and most webhook systems use to prove that a payload really came from them and wasn't tampered with in transit. CipherForces HMAC Calculator computes and verifies HMAC signatures entirely in your browser, with two dedicated modes built around real debugging workflows — not generic "hash some text" output.
Paste the message body, paste or type the secret key, pick the algorithm (SHA-1, SHA-256, SHA-384, SHA-512), and get the signature in both hex and base64. Key input accepts UTF-8 text, hex, or base64 — common formats used by different vendors. Useful when you're generating a signed request to send to an API that expects HMAC auth, or when you're building the verification logic on the receiving side and need a known-good signature to test against.
Paste the message body, paste the secret, paste the signature you received, and the tool returns a clear ✓ match or ✗ no-match indicator. This is the killer feature for webhook debugging — when Stripe sends you a Stripe-Signature header and your server says "invalid signature," you can drop the raw body, your endpoint secret, and the header value into this tool and find out within a second whether the bug is in your signature comparison or in your body parsing (the most common cause: invisible whitespace or JSON re-stringification mangling the body).
HMAC computation uses the browser's native crypto.subtle API. Your message body and secret key never leave your device. Compare that to "free" online HMAC tools that log every payload + secret you paste — handing them production webhook secrets is exactly what you don't want to do when debugging.
Paste your message payload into the input field, enter your shared secret key, and choose a hash algorithm like SHA-256. The tool computes the HMAC instantly in your browser and shows the signature in hex. Copy it to compare against the value in your webhook header.
No. This HMAC calculator runs entirely in your browser using JavaScript, so your secret key and message never leave your device. Nothing is sent to any server, there is no signup, and no data is stored. You can even use it offline once the page has loaded.
Yes. Generate the HMAC from the same payload and secret you received, then compare it to the signature in your incoming request. If they match, the message is authentic and unchanged. This is the standard way to confirm a webhook genuinely came from the sending service.
The tool supports HMAC with SHA-1, SHA-256, SHA-384, and SHA-512. SHA-256 is the most common choice for modern webhooks from providers like Stripe and GitHub. Pick the algorithm your service documents, since a mismatched hash will always produce a different signature.
Drag and drop or click to select your file.
Adjust quality, size, or format options.
Your processed file is ready instantly.
Generate SHA-1, SHA-256, SHA-384, SHA-512 hashes for text and files.
Open toolVerify file integrity by comparing SHA-256 checksums.
Open toolEncrypt text and files with AES-256. Decrypt with your password.
Open toolCheck any website's SSL certificate and security headers.
Open toolOne team for your website, print, automation & branding — websites from $799.
Explore all 83 tools