HMAC Verifier

What is HMAC verification?

Verification checks whether a supplied authentication tag really matches a message under a given key. The result is valid or invalid.

• Secret key (hex): required. Hexadecimal bytes of the shared secret.
• Message: typed text or a file.
• Expected HMAC (hex): the tag you were given.
• Hash algorithm: SHA-256 by default, plus SHA-384, SHA-512, SHA3-256, and SHA3-512. It has to match whatever produced the tag.

Why comparison is the delicate part

Checking a tag looks like comparing two strings, and doing it the obvious way leaks information. A comparison that stops at the first differing byte takes slightly longer when more of the prefix is correct. An attacker who can measure that timing can recover a valid tag one byte at a time without ever knowing the key.

This tool compares in constant time, examining every byte regardless of where the first mismatch occurs. It is the kind of detail that is invisible when it is right and quietly fatal when it is wrong, which is why hand-rolled verification is a classic source of vulnerabilities.

Are there alternatives?

HMAC Generator produces the tags this verifies. Generating a tag yourself and comparing it by eye works for debugging but reintroduces the comparison problem above if you script it carelessly.

For verifying a password rather than a message, use Argon2 Hash Verifier. For ciphertext that must stay secret, an AEAD such as AES-GCM verifies and decrypts in one step.

Fun facts and more info

A valid result proves that whoever produced the tag knew the shared secret, and that the message has not been altered since. It does not identify who that was. Both parties hold the same key, so either could have produced any given tag, and an HMAC therefore cannot settle a dispute about authorship the way a digital signature can.

An invalid result is not diagnostic either. A wrong key, a modified message, the wrong algorithm, and a corrupted tag all look identical from here.