ffee All tools
EN 中文 FR DE

HMAC Verifier

Recompute an HMAC signature and check it against the value you received, in hex or Base64.

Verify an HMAC signature

Verdict: —
Computed hex: —
Computed Base64: —
Key: —
The signature is computed with crypto.subtle.importKey and sign; the key and message never leave your browser.

How to use the HMAC Verifier

  1. Paste the exact message that was signed into the message box.
  2. Enter the shared secret key and choose the hash algorithm.
  3. Paste the signature you received and read the verdict.

Features

Advertisement

More tools

File Hash Checker Checksum Verifier Hash Identifier Bcrypt Hash Generator Bcrypt Verifier PBKDF2 Generator TOTP Generator OTP Secret Generator Hash Comparison Password Entropy Analyzer CRC32 Calculator Adler32 Calculator

Frequently Asked Questions

Common questions about the free online hmac verifier.

A hash based message authentication code combines a message with a secret key, so anyone holding the key can prove the message was not changed.
Paste the raw request body, enter the shared secret, select the same algorithm as the sender and compare the signature header value.
The usual causes are a changed message, whitespace differences, a wrong secret or a different algorithm. Always verify the raw bytes.
No for hexadecimal values, which are compared in lower case. Base64 is compared exactly, apart from optional padding.
No. HMAC comparison needs the whole digest, so a shortened value never matches.
The tool compares every character without stopping early, mirroring best practice, though a browser page has no real timing threat to defend against.
No. The key and message stay in your browser and are passed only to the Web Crypto API in the page.
Yes. It is completely free, works offline once loaded, and needs no account, no sign-up and no installation.

Last updated: October 10, 2026