ToolAtlas
FavoritesRecent

HMAC / password check

Processed in this browser

Text limit: 2000000 characters

This tool never uploads your input.

HMAC-SHA-256 of a message plus a key, and a local password strength score. This is not how you should store user passwords (use Argon2/bcrypt on a server) and not a password generator.

An API wants HMAC-SHA-256(secret, body), or you want a local strength score on a string you already have. That is this page.

Hash generator is unkeyed text. Password generator mints new passwords. File SHA-256 is files.

How to use it

  1. Enter message and key for HMAC, or paste a password to score.
  2. Copy the hex. Compare encodings (hex vs base64) with the docs.
  3. Do not check a live production password against a random website — confirm this tab with the Network panel if you are nervous.

Honest limits

  • Not bcrypt/Argon2.
  • Not a breach-database lookup.
  • Wrong encoding (UTF-8 vs bytes) is the usual interop fail.

This is a local crypto helper, not a vault.

FAQ

Is HMAC encryption?

No. It is a keyed hash for integrity. Anyone with the key can recompute it.

Should I HMAC passwords for storage?

No. Use a slow password hash with a unique salt. This page is for API signing tests and a casual strength score.

Is this the password generator?

No. Generate a new string there, then score it here if you want.

File HMAC?

Not this build. File SHA-256 is an unkeyed file digest.

Is the key uploaded?

No. Still treat production HMAC keys as secrets.

Related tools