HMAC Verifier

What is HMAC verification?

Verification checks whether a supplied authentication tag really matches a message under a given key. Supply the key as hexadecimal, the data, the tag to check, and the algorithm, and the result is a simple valid or invalid.

The algorithms match the generator: SHA-256 by default, plus SHA-384, SHA-512, SHA3-256, and SHA3-512.

Why comparison is the delicate part

Checking a tag looks like comparing two strings, and doing it the obvious way leaks information. A comparison that stops at the first differing byte takes slightly longer when more of the prefix is correct, and an attacker who can measure that timing can recover a valid tag one byte at a time without ever knowing the key.

This tool compares in constant time, examining every byte regardless of where the first mismatch occurs. It is the kind of detail that is invisible when it is right and quietly fatal when it is wrong, which is why hand-rolled verification is a classic source of vulnerabilities.

The key also stays on your machine rather than being sent to the server for checking.

Are there alternatives?

HMAC Generator produces the tags this verifies. Generating a tag yourself and comparing it by eye works for debugging but reintroduces exactly the comparison problem described above if you script it carelessly.

For verifying a password rather than a message, use Argon2 Hash Verifier. For ciphertext, Authenticated Decryption verifies and decrypts in one step.

Fun facts and more info

A valid result proves that whoever produced the tag knew the shared secret, and that the message has not been altered since. It does not identify who that was. Both parties hold the same key, so either could have produced any given tag, and an HMAC therefore cannot settle a dispute about authorship the way a digital signature can.

An invalid result is not diagnostic either. A wrong key, a modified message, the wrong algorithm, and a corrupted tag all look identical from here.