HMAC keys a digest of your file with a key you type, printing HMAC and the algorithm, then the digest below. Pick MD5, SHA1, SHA256, SHA384 or SHA512. The key is used as typed, so a hex key never matches a system that decodes it first. Give an expected value and it answers valid or invalid instead.
Questions
What does an HMAC give me that a plain hash does not?
It ties the digest to a key. Anyone can recompute the SHA-256 of a file, but only someone holding the key can produce or check the matching HMAC, which is what makes it useful against deliberate changes rather than accidental ones. This tool takes a key as text and a file, and prints HMAC and the algorithm name, then the filename, then the digest on the next line.
Which algorithms can I choose?
MD5, SHA1, SHA256, SHA384 and SHA512, with SHA256 as the default. MD5 and SHA1 are present so you can reproduce values from older systems. Whichever you pick has to match the other side exactly, since HMAC-SHA1 and HMAC-SHA256 over the same file with the same key produce completely unrelated values.
Is the key text or bytes?
Text. You type it into the key option and it goes to hash-wasm as it stands. If your key is a hex or base64 blob, typing that string computes an HMAC over those characters, not over the bytes they encode, and it will not match a system that decodes the key first. There is no option here to enter a key as hex.
Can I use it to verify a download?
Only if the publisher publishes an HMAC and you also hold the key, which is unusual. Downloads are normally checked with a plain digest, so use Generate all hashes or a dedicated hash tool and compare against the published value. HMAC is for the case where you and the other side already share a secret.
Where does the key go?
Into a Web Worker in this tab and nowhere else. hash-wasm runs as WebAssembly on your device, the file is read locally, and neither the key nor the file is uploaded. Nothing is stored between runs, and the tool works with the network off.
Can it check an HMAC I already have?
Yes. Put the value in the expected option, as hex or as base64, and the result becomes valid or invalid instead of a digest. The two byte strings are compared in constant time, so timing gives nothing away about where they differ. Leave expected blank and the tool prints the HMAC as before.
Can I HMAC several files at once?
Yes. Drop as many as you like and each one is processed separately with the same key and algorithm, giving one result per file with its own filename line. Nothing is combined, so this does not produce a single HMAC over a whole folder.