BuildUtilities

What is HMAC?

A hash plus a shared secret, proves a message came from someone who knows the secret AND wasn't tampered with.

HMAC stands for Hash-based Message Authentication Code. It takes a message and a secret key, runs them through a hash like SHA-256 in a specific way, and outputs a short tag.

If you and I share the secret, you can send me a message + HMAC tag. I recompute the HMAC with the same secret, if it matches, the message is authentic and untampered.

It's used in webhook signatures (Stripe, GitHub, Shopify), AWS request signing, and as a building block inside TLS, JWTs (HS256), and password derivation functions.

Related tools

Keep reading

Tip Jar