Skip to content
ToolsOnDuty - free online tools
Security & Cryptography

HMAC Verifier

Check whether an HMAC signature matches a message and secret.

Free foreverRuns in your browserNo sign-up

The HMAC is recomputed and compared in your browser. Your message and secret are never uploaded.

100% private - runs entirely in your browser.

Your input, keys and passwords are never uploaded. Want proof? Load this page, then turn off your internet - the tool still works. For an exact check, open your browser's DevTools Network tab and confirm no data is sent when you use it.

About the HMAC Verifier

Check whether an HMAC signature is valid for a given message and secret, the reverse of generating one.

Enter the message, secret, algorithm and the expected HMAC, and the tool confirms whether they match.

Everything runs in your browser with the Web Crypto API, so nothing is uploaded.

Key features

  • Verify HS256, SHA-1, SHA-384 and SHA-512 HMACs
  • Case-insensitive hex comparison
  • Instant match or no-match result
  • Runs entirely in your browser

How to use

  1. 1Enter the message and secret key.
  2. 2Choose the algorithm and paste the expected HMAC.
  3. 3Read whether it matches.

Examples

Valid signature
Input: message + secret + correct HMAC
Output: Match

The recomputed HMAC equals the expected one.

Wrong HMAC
Input: message + secret + wrong HMAC
Output: No match

Any change to the message, secret or HMAC fails.

Frequently asked questions

What is HMAC verification for?
It confirms that a message came from someone who knows the secret and was not changed, common for webhooks and signed API requests.
Does the case of the hex matter?
No. The comparison is case-insensitive, so upper or lower case hex both work.
Is my data uploaded?
No. The HMAC is recomputed and compared entirely in your browser.

Related tools