HMAC stands for Hash-based Message Authentication Code. It takes a message and a secret key, runs them through a hash like SHA-256 in a specific way, and outputs a short tag.
If you and I share the secret, you can send me a message + HMAC tag. I recompute the HMAC with the same secret, if it matches, the message is authentic and untampered.
It's used in webhook signatures (Stripe, GitHub, Shopify), AWS request signing, and as a building block inside TLS, JWTs (HS256), and password derivation functions.