Compute HMAC-SHA256, HMAC-SHA384, HMAC-SHA512 message authentication codes for text or files and verify signatures.
Given a shared secret and either text or a file, HMAC Generator & Verifier produces an HMAC with SHA-256, SHA-384, or SHA-512 and compares an expected code against a freshly computed one. It does not encrypt the message or identify who created it. Every input byte matters: a trailing newline, different text encoding, changed file content, or treating a hexadecimal-looking key as literal text can yield a different code. Because keys and file contents are sensitive, processing stays in the browser and nothing is uploaded.
A concrete input and expected output from the current implementation.
Input
Algorithm: HMAC-SHA256 Key (text): key Message (text): The quick brown fox jumps over the lazy dog
Expected output
f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
Using the key and message as ASCII bytes, HMAC-SHA256 produces this 32-byte tag, displayed as 64 lowercase hexadecimal characters. Changing either input, including its spaces or line ending, is overwhelmingly likely to produce a different tag.
HMAC combines a secret key with the selected SHA-2 hash in two passes. Conceptually, it hashes a key-derived inner pad followed by the message, then hashes a key-derived outer pad followed by that first digest. Keys longer than the hash's block size are hashed first; shorter keys are zero-padded for the pad calculation. The chosen SHA variant determines the tag length.
Verification recomputes the HMAC from the entered key, selected SHA variant, and exact message or file bytes, then compares it with the supplied tag. A match means those inputs are consistent with the tag. A mismatch does not reveal whether the key, message, algorithm, text encoding, or tag representation was different.
A plain SHA-256 hash includes only the message and can be reproduced by anyone who has it. HMAC-SHA256 also incorporates a secret key through defined inner and outer hashing steps. Consequently, the HMAC is not expected to equal the ordinary SHA-256 digest, even when both operations use the same message.
Yes, when the sender uses HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512 and you know the secret, exact signed bytes, and tag representation. No, it cannot automatically reconstruct a provider-specific signing string. If the scheme prefixes a timestamp, signs the raw request body, or applies canonicalization, reproduce those rules before comparing the tag.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.