Verify an expected HMAC locally

Enter the same message bytes, secret key, algorithm, and output encoding used by the source system. Nothing is uploaded by this tool.

Message

Secret key

Algorithm

Expected format

Expected HMAC

ReadyComparison

—Computed HMAC

HMAC authenticates data only when the shared key remains secret and both sides use the same algorithm and exact message bytes. A matching digest does not prove who originally possessed the key.

Integrity and authenticity are different jobs

v10.77 connects text/file digests, checksum verification and HMAC workflows while keeping the underlying historical tools intact. Hashes compare exact bytes; HMAC additionally depends on a shared secret key.

Password-storage boundary

Fast hashes such as SHA-256, SHA-1 and MD5 are not password-storage schemes. Production password storage should use a purpose-built slow password hashing/KDF design with salts and reviewed parameters; legacy algorithms remain here only for compatibility and checksum workflows.

How to use this HMAC Verifier

Recompute an HMAC locally and compare it with an expected hexadecimal or Base64 digest without uploading the message or key.

Enter, paste, upload, or choose the inputs shown in the tool above.
Adjust the available options for the result you need.
Review the output before copying, downloading, or using it elsewhere.

What this tool does

Choose SHA-256, SHA-384, or SHA-512, enter a message and secret key, then verify an expected HMAC locally in the browser.

Practical tips and limits

Review the inputs and result before using the output elsewhere. Keep the original data when the operation changes or replaces content.