Verify an HMAC authentication code against a message or file, using a hexadecimal secret key and SHA-2 or SHA-3.
Runs in your browser — your input is processed on this device and never uploaded.
Results appear here.
Verification checks whether a supplied authentication tag really matches a message under a given key. The result is valid or invalid, and the tags are compared in constant time so the check itself leaks nothing.
Checking a tag looks like comparing two strings, and doing it the obvious way leaks information. A comparison that stops at the first differing byte takes slightly longer when more of the prefix is correct. An attacker who can measure that timing can recover a valid tag one byte at a time without ever knowing the key.
This tool compares in constant time, examining every byte regardless of where the first mismatch occurs. It is the kind of detail that is invisible when it is right and quietly fatal when it is wrong, which is why hand-rolled verification is a classic source of vulnerabilities.
HMAC Generator produces the tags this verifies. Generating a tag yourself and comparing it by eye works for debugging but reintroduces the comparison problem above if you script it carelessly.
For verifying a password rather than a message, use Argon2 Hash Verifier. For ciphertext that must stay secret, an AEAD such as AES-GCM verifies and decrypts in one step.
A valid result proves that whoever produced the tag knew the shared secret, and that the message has not been altered since. It does not identify who that was. Both parties hold the same key, so either could have produced any given tag, and an HMAC therefore cannot settle a dispute about authorship the way a digital signature can.
An invalid result is not diagnostic either. A wrong key, a modified message, the wrong algorithm and a corrupted tag all look identical from here.
Find similar tools by category or tag.