HMAC generator and signature checker

Every common HMAC of a message at once. Paste the signature you received and it is checked in constant time against each one, and the page names the algorithm that matches.

JavaScript is off, so the in-browser engine can't run. Submitting a form sends it to this server instead, where it is processed in memory and neither logged nor stored.

Message Message is

Key Key is

Expected signature (optional)

Checking a GitHub, Stripe or Slack webhook?

They sign the raw request body with HMAC-SHA256. Paste the body exactly as it arrived: parsed and re-serialised JSON has different bytes and will not match. GitHub's sha256= prefix is removed for you. Stripe signs timestamp.body and Slack v0:timestamp:body, so put that string in the message.

Using this from the terminal

Every tool here also answers a plain POST with JSON. From a terminal your input goes to this server, unlike on the page, which runs everything in your browser.

curl https://cipher.corpberry.com/hmac --data-urlencode [email protected] -d key=secret -d expected=sha256=…

POST only. Fields: text, enc, key, key_enc (utf8, hex, base64, base64url), expected. --data-urlencode text@file sends the file byte for byte. The API runs on this server, so the key travels; this page doesn't send it anywhere.

From an AI agent (MCP): https://mcp.corpberry.com/mcp/cipher · setup