HMAC
Compute an HMAC of a file with a key, on your device.
Runs on your device. The file is never uploaded.
HMAC keys a digest of your file with a key you type, printing HMAC and the algorithm beside the file name, then the digest on the line below. Pick MD5, SHA1, SHA256, SHA384 or SHA512, with SHA256 as the default. The key is used as the characters typed, so a hex key never matches a system that decodes it first.
Questions
What does an HMAC give me that a plain hash does not?
It ties the digest to a key. Anyone can recompute the SHA-256 of a file, but only someone holding the key can produce or check the matching HMAC, which is what makes it useful against deliberate changes rather than accidental ones. This tool takes a key as text and a file, and prints HMAC and the algorithm name, then the filename, then the digest on the next line.
Which algorithms can I choose?
MD5, SHA1, SHA256, SHA384 and SHA512, with SHA256 as the default. MD5 and SHA1 are present so you can reproduce values from older systems. Whichever you pick has to match the other side exactly, since HMAC-SHA1 and HMAC-SHA256 over the same file with the same key produce completely unrelated values.
Is the key text or bytes?
Text. You type it into the key option and it goes to hash-wasm as it stands. If your key is a hex or base64 blob, typing that string computes an HMAC over those characters, not over the bytes they encode, and it will not match a system that decodes the key first. There is no option here to enter a key as hex.
Can I use it to verify a download?
Only if the publisher publishes an HMAC and you also hold the key, which is unusual. Downloads are normally checked with a plain digest, so use Generate all hashes or a dedicated hash tool and compare against the published value. HMAC is for the case where you and the other side already share a secret.
Where does the key go?
Into a Web Worker in this tab and nowhere else. hash-wasm runs as WebAssembly on your device, the file is read locally, and neither the key nor the file is uploaded. Nothing is stored between runs, and the tool works with the network off.
Can I HMAC several files at once?
Yes. Drop as many as you like and each one is processed separately with the same key and algorithm, giving one result per file with its own filename line. Nothing is combined, so this does not produce a single HMAC over a whole folder.