What's the difference between Personal and Studio?

Personal ($39) is for one person — unlimited use on one active device at a time. Activate on a new device and the old one signs out. Studio ($199) is for teams and commercial client work — unlimited team members, early access to new tools, and a commercial license.

Do I need an account?

No. Use any tool free up to 5 times per day on compute-heavier tools, and unlimited on lightweight ones. No card, no account, no signup required.

Where are my files processed?

Right on your device. Files never upload to any server. Everything runs in your browser — you can verify in DevTools → Network.

What happens if I use my Personal license on a second device?

The new device activates and the old device signs out. Your license key stays the same — you just move it between devices as needed. No limit on how often you switch.

Does this work on my phone?

Yes. Every tool works on iPhone, Android, tablet, and desktop.

What if I want a refund?

30-day money-back guarantee on both tiers. No questions asked. Email sales@cipherforces.com.

Will you add more tools?

Yes. New tools ship regularly. Your license includes every tool we ever release — Studio members get early access.

SecurityFree

HMAC Calculator

Generate or verify HMAC signatures (SHA-1, SHA-256, SHA-384, SHA-512). Built for webhook signature debugging.

By Daniel BeglaryanUpdated May 2026

PrivateWorks OfflineNo Account

100% Private Works Offline Web Crypto API

Algorithm

Message / Payload

Whitespace and newlines are significant — paste the body exactly as it was transmitted.

Secret Key

Deep dive

About HMAC Calculator.

Generate and Verify HMAC Signatures — Locally

HMAC (Hash-based Message Authentication Code) is what Stripe, GitHub, Twilio, Slack, and most webhook systems use to prove that a payload really came from them and wasn't tampered with in transit. CipherForces HMAC Calculator computes and verifies HMAC signatures entirely in your browser, with two dedicated modes built around real debugging workflows — not generic "hash some text" output.

Generate Mode

Paste the message body, paste or type the secret key, pick the algorithm (SHA-1, SHA-256, SHA-384, SHA-512), and get the signature in both hex and base64. Key input accepts UTF-8 text, hex, or base64 — common formats used by different vendors. Useful when you're generating a signed request to send to an API that expects HMAC auth, or when you're building the verification logic on the receiving side and need a known-good signature to test against.

Verify Mode

Paste the message body, paste the secret, paste the signature you received, and the tool returns a clear ✓ match or ✗ no-match indicator. This is the killer feature for webhook debugging — when Stripe sends you a Stripe-Signature header and your server says "invalid signature," you can drop the raw body, your endpoint secret, and the header value into this tool and find out within a second whether the bug is in your signature comparison or in your body parsing (the most common cause: invisible whitespace or JSON re-stringification mangling the body).

Common Use Cases

Webhook signature verification: Stripe, GitHub, Twilio, Slack, Shopify, Vercel, Linear — all use HMAC-SHA256 over the raw request body with a shared secret.
Build a known-good test: When implementing webhook auth on your server, generate a signature with this tool and unit-test against it.
Debug "invalid signature" errors: Compare what your server computes against what the vendor sent — instantly see whether the body or the secret is the problem.
API request signing: AWS Signature v4, OAuth 1.0a, and many internal APIs use HMAC over a canonical request string.

Privacy

HMAC computation uses the browser's native crypto.subtle API. Your message body and secret key never leave your device. Compare that to "free" online HMAC tools that log every payload + secret you paste — handing them production webhook secrets is exactly what you don't want to do when debugging.

FAQ

Frequently asked questions.

How do I generate an HMAC signature for a webhook?

Paste your message payload into the input field, enter your shared secret key, and choose a hash algorithm like SHA-256. The tool computes the HMAC instantly in your browser and shows the signature in hex. Copy it to compare against the value in your webhook header.

Is my secret key uploaded to a server when I use this HMAC calculator?

No. This HMAC calculator runs entirely in your browser using JavaScript, so your secret key and message never leave your device. Nothing is sent to any server, there is no signup, and no data is stored. You can even use it offline once the page has loaded.

Can I verify an HMAC signature instead of just generating one?

Yes. Generate the HMAC from the same payload and secret you received, then compare it to the signature in your incoming request. If they match, the message is authentic and unchanged. This is the standard way to confirm a webhook genuinely came from the sending service.

What hash algorithms does this HMAC generator support?

The tool supports HMAC with SHA-1, SHA-256, SHA-384, and SHA-512. SHA-256 is the most common choice for modern webhooks from providers like Stripe and GitHub. Pick the algorithm your service documents, since a mismatched hash will always produce a different signature.

Three steps