Running on your device · 0 bytes uploaded

# HMAC generator and verifier

Keyed MACs over any text — SHA-1, SHA-256, SHA-384, SHA-512 through WebCrypto, keys as text, hex, or base64. RFC 4231-exact, computed in your tab.
SHA-1SHA-256SHA-384SHA-512Text keyhexbase64KeyMessageCompute HMACExpected MACCheck

- No encryption, only authentication — an HMAC proves the message and key match, it hides nothing.
- The shared secret lives in this tab’s memory while you work — nothing is sent or stored, a browser tab cannot guarantee the memory is zeroized after, and browser extensions can read page content.
- The comparison here is for pasted digests, not live secrets — production verifiers compare in constant time.
- SHA-1 HMAC still resists collision attacks in this role, but new systems pick SHA-256 or better.
Nothing in yet

Paste, drop, or type to begin. Everything stays on this device.

key + message, then compute

## Next door in Crypto

- [TOTP generator & verifier](/web/totp)
- [Hash generator](/crypto/hash)
[All crypto tools](/crypto)

---

Canonical HTML: https://nutter.tools/crypto/hmac
Markdown version: https://nutter.tools/crypto/hmac/index.md
Plain-text version: https://nutter.tools/crypto/hmac/index.txt
Agent index: https://nutter.tools/llms.txt