Keyed authentication

Generate or verify an HMAC

HMAC authenticates a message with a shared secret key. The key and message remain in this browser.

HMAC tool

Runs locally

HMAC

HMAC is not password hashing. For stored passwords, use a purpose-built password hashing function with a salt and work factor.

JavaScript is required for this local tool

The rest of unHash remains server-rendered. This page uses browser cryptography specifically so files, keys, and messages do not need to be sent to the server.

Privacy boundary

This tool has no upload endpoint. Analytics, when configured, receives only allowlisted action names such as completion or verification—not filenames, digest values, keys, messages, file contents, or expected checksums.