Content is not executed; only explainable static patterns and bounded browser operations are applied.
83
Privacy & security
HMAC Generator & Verifier
Uses Web Crypto to create HMAC from a UTF-8 key and message, outputs hex or Base64URL, and checks an optional expected value with a length-normalized byte comparison. JavaScript runtimes do not guarantee constant-time execution. Keys must remain secret; HMAC is not encryption, identity proof, or a public-key signature.
✓ Free✓ No account✓ In-browser
QUICK ANSWER
What does this tool do?
Generate HMAC-SHA-256/384/512 and locally compare an optional expected digest.
APPLICATION AND DECISION GUIDE
HMAC Generator & Verifier: method and usage
Uses Web Crypto to create HMAC from a UTF-8 key and message, outputs hex or Base64URL, and checks an optional expected value with a length-normalized byte comparison. JavaScript runtimes do not guarantee constant-time execution. Keys must remain secret; HMAC is not encryption, identity proof, or a public-key signature.
synthetic or minimized code, configuration, identifiers, or file content you are authorized to review Confirm the shape first with a small example containing no personal data.
evidence locations, severity, false-positive considerations, and the next verification action
Practical steps
- Enter only a test key and message you are authorized to use.
- Choose algorithm and output format, then generate the HMAC.
- In production, follow the provider's byte encoding and canonicalization rules exactly.
manual review at the source location and independent verification with an appropriate professional security tool or authorized process
This is a pre-check, not a guarantee of identity, security, or regulatory compliance.
Suitable use cases
- Debugging webhook signatures
- Creating test fixtures
- Verifying message integrity
LEARN THE WORKFLOW
Guides for this tool
Local Security Guide to Web Crypto, RAG, and Prompt Injection
Apply passphrases, HMAC, SRI, CIDR, RAG budgets, and injection pre-scans with correct security boundaries.
Read guide →EXIF and Metadata Safety Before Sharing a Photo
Find location, device, capture-time, and editing traces, then verify the cleaned copy before sharing.
Read guide →ABOUT THIS TOOL
Frequently asked questions
What input does HMAC Generator & Verifier accept?+
synthetic or minimized code, configuration, identifiers, or file content you are authorized to review Enter only a test key and message you are authorized to use.
What does HMAC Generator & Verifier return?+
evidence locations, severity, false-positive considerations, and the next verification action Content is not executed; only explainable static patterns and bounded browser operations are applied.
How should I validate HMAC Generator & Verifier output?+
manual review at the source location and independent verification with an appropriate professional security tool or authorized process
Does HMAC Generator & Verifier send or store input on a server?+
Tool input is processed in the active tab. Saving to the Workstation or transferring to another tool is a separate choice. Consider browser extensions and shared devices separately; the privacy page explains advertising and network connections.