Hashing, HMAC, and String Comparison

Cryptographic Hashing

A cryptographic hash function converts input data into a fixed-length digest.

Cryptology Monster supports:

Hashing does not encrypt data and cannot ordinarily be reversed to recover the input.

Hashing Text

1. Select Hash.
2. Choose SHA-256, SHA-384, or SHA-512.
3. Enter text.
4. Click Hash Text.
5. Copy the hexadecimal digest.

Example

SHA-256 of:

hello

is:

2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

The text is encoded as UTF-8 before hashing.

Even small changes to the input generally produce different digests.

Hashing Files

1. Select Hash.
2. Choose a hash algorithm.
3. Select a file.
4. Click Hash File.
5. Review the digest.

The file hashing function processes the original bytes without converting them to text.

The result window displays:

• Filename
• File size in bytes
• Hexadecimal digest

Common Uses

• Comparing file checksums
• Detecting accidental file changes
• Checking downloaded-file integrity against a trusted digest
• Identifying duplicate byte-for-byte content

A hash alone does not prove authenticity unless the expected hash is obtained from a trustworthy source.

HMAC Message Authentication

HMAC is a keyed message authentication mechanism.

Unlike an ordinary hash, HMAC requires a secret key.

Supported Algorithms

Generating an HMAC

1. Select HMAC.
2. Choose the algorithm.
3. Enter the message.
4. Enter the secret key.
5. Enable Key is hex if the secret is entered as hexadecimal bytes.
6. Click Sign.

Output

The result contains the HMAC signature in:

• Hexadecimal
• Base64url

These representations contain the same signature bytes.

Verifying an HMAC

1. Select the same HMAC algorithm used to generate the signature.
2. Enter the original message.
3. Enter the shared secret key.
4. Enter the signature.
5. Enable Signature is hex if applicable.
6. Click Verify.

The result indicates whether the signature matches.

Example Message

transaction=approved

If the secret or message changes, the computed HMAC will generally no longer match.

Key Formats

Text Secret

When Key is hex is disabled, the entered secret is UTF-8 encoded.

Hex Secret

When enabled, the application interprets the secret as hexadecimal bytes.

For example:

48656c6c6f

represents the bytes of Hello.

Use the same key representation for signing and verification.

HMAC Security

HMAC provides integrity and authentication to parties sharing the secret.

It does not encrypt the message.

Anyone possessing the shared secret can generate valid HMAC signatures.

String Comparison

The String Comparison tool checks whether two JavaScript strings are exactly equal.

Usage

1. Select Compare Strings.
2. Enter the first string.
3. Enter the second string.
4. Click Compare.

Results

The tool reports either:

Strings match exactly.

or:

Strings do NOT match.

When the lengths differ, it also displays both lengths.

Comparison Behavior

The implementation uses strict JavaScript equality:

str1 === str2

The comparison is:

• Case-sensitive
• Whitespace-sensitive
• Sensitive to character differences

For example:

Hello

and:

hello

do not match.

Security Limitation

The tool does not implement constant-time comparison.

It should not be used as a substitute for proper cryptographic verification of secret tokens or authentication tags.

Choosing the Right Tool

Important: Hashing, message authentication, and encryption solve different security problems.