What Is HMAC and When Should You Use It?
HMAC combines a secret key with a hash to prove a message is authentic and unaltered. Learn how it differs from a plain hash and where it is used.
HMAC (Hash-based Message Authentication Code) mixes a secret key into a hash so the result proves both that a message is unchanged and that it came from someone who knows the key. A plain hash only proves the data is unchanged, not who produced it.
Hash vs HMAC
- A hash (like SHA-256) is public — anyone can compute it, so anyone could alter a message and recompute the hash.
- An HMAC requires the secret key, so only parties who share the key can produce or verify it. That makes it a signature of authenticity.
Where it is used
- Webhooks — services sign each payload with HMAC so you can verify it really came from them
- API requests — signing requests to prevent tampering
- Session tokens — verifying a token was issued by your server
A quick note
Compare HMACs with a constant-time check to avoid timing attacks, and keep the secret key truly secret — its strength is the whole security.
Try it
Generate an HMAC with SHA-256 and a key in the HMAC generator, all in your browser. To understand the hash underneath, see MD5 vs SHA-256.