Cybersecurity glossary
What is Hash-Based Message Authentication Code (HMAC)?
Learn what HMAC is, how keyed hash message authentication codes prove integrity and authenticity, where HMAC-SHA-256 is used, and how HMAC differs from AEAD encryption.
Definition
Hash-Based Message Authentication Code (HMAC) is a symmetric message authentication code that combines a secret key with a cryptographic hash function to prove that data came from someone with the key and was not modified.
Why HMAC remains everywhere
Systems need to know when a message changed in transit or was forged by someone without the right secret. Hash-Based Message Authentication Code (HMAC) solves that problem with a symmetric key and a cryptographic hash function, producing a tag that receivers can verify before trusting the data.
HMAC is widely deployed because it is simple to use through standard libraries, works with SHA-2 hashes, and has survived years of protocol review in TLS-era systems, API signing, webhooks, token formats, and key derivation.
What HMAC provides
HMAC is a keyed hash MAC: the key turns a public hash function into a message authentication code. The output is not just a checksum. It is an integrity proof tied to secret key material.
Message integrity
Changing even one protected byte causes verification to fail under the shared key.
Symmetric authenticity
A valid tag shows that whoever produced it had the same secret key.
Hash agility
HMAC can be instantiated with approved hashes such as SHA-256, SHA-384, or SHA-512.
No confidentiality
HMAC does not encrypt the message; observers can still read any plaintext that travels with the tag.
How HMAC signing and verification work
Choose a secret key
Generate high-entropy key material for MAC use and keep it separate from encryption keys.
Canonicalize the message
Agree on the exact bytes to authenticate, including headers, body, timestamps, or claims.
Compute the HMAC
The algorithm mixes the key with inner and outer hash passes to produce a fixed-size tag.
Send message and tag
The verifier receives the clear message plus the authentication tag; the key never travels.
Recompute and compare
The receiver computes HMAC over the same bytes and compares tags with a constant-time routine.
Accept or reject
Only messages with valid tags move into application processing.
HMAC, AEAD, and signatures compared
| Primitive | What it protects | Key model | Common use |
|---|---|---|---|
| HMAC | Integrity and shared-key authenticity | Symmetric secret | API request signing, webhooks, JWS HS256, HKDF |
| AEAD | Confidentiality plus integrity | Symmetric secret and unique nonce | TLS records, encrypted tokens, envelope encryption |
| Digital signature | Integrity and public-key authenticity | Private signing key, public verification key | Software releases, asymmetric JWS, certificates |
HMAC and AEAD are often complementary but not interchangeable. HMAC authenticates bytes that remain visible. AEAD encrypts plaintext and authenticates ciphertext plus optional associated data in one reviewed construction. For new message encryption, prefer AEAD rather than manually combining encryption and HMAC unless a protocol specifically defines that composition.
HMAC in JWT and JWS
JWS can use HMAC through the HS256, HS384, and HS512 algorithms. In that mode, the issuer and verifier share the same secret, and the MAC covers the base64url-encoded protected header and payload. This protects token claims from tampering, but it does not encrypt them.
The dangerous part is policy, not the math. JWT verifiers should allow only expected algorithms, bind keys to algorithm families, reject none, rotate shared secrets carefully, and avoid confusing HMAC secrets with RSA or elliptic-curve public keys.
SHA-2 HMAC choices
HMAC is commonly written as HMAC-SHA-256 or HMAC-SHA-384 because the hash is an input to the construction. SHA-2 remains the usual default for interoperability and compliance. HMAC also softens some risks that would break naive hash-based MACs, such as length-extension attacks against constructions that simply hash key || message.
- Use HMAC-SHA-256 as a practical default unless a protocol requires another approved SHA-2 variant.
- Generate MAC keys with enough entropy; do not use human passwords directly as HMAC keys.
- Authenticate the exact canonical bytes that the receiver will interpret.
- Use constant-time tag comparison from the platform crypto library.
- Separate keys by purpose: one key for HMAC, another for encryption, and another for token signing when possible.
- Truncate tags only when a standard defines safe truncation lengths for your use case.
- Prefer AEAD when data also needs confidentiality.
- For JWS HS* tokens, enforce an algorithm allowlist and rotate shared secrets with overlap windows.
The practical takeaway
HMAC is the standard keyed hash MAC for proving that visible data was not modified and came from someone with the shared secret. Use SHA-2 based HMAC through trusted libraries, keep keys separate and high entropy, compare tags in constant time, and reach for AEAD when encryption is part of the job.
Related security terms
Authenticated Encryption with Associated Data (AEAD)
Modern authenticated encryption that combines confidentiality and integrity in one construction.
Secure Hash Algorithm 2 (SHA-2)
The hash family most commonly paired with HMAC in HMAC-SHA-256 and HMAC-SHA-384.
Symmetric Cryptography
The broader class of cryptography where communicating parties share secret key material.
Key Derivation Function (KDF)
A function family that often uses HMAC internally, such as HKDF.
JSON Web Signature (JWS)
The JOSE signature format where HS256 and related algorithms use HMAC.
Frequently asked questions
What is HMAC in simple terms?
HMAC is a way to attach a short integrity tag to a message using a shared secret. Anyone with the same secret can verify the tag, but attackers without the secret cannot forge a valid one.
Does HMAC encrypt data?
No. HMAC authenticates data but does not hide it. Use encryption, or preferably AEAD, when the message must remain confidential.
What does HMAC prove?
A valid HMAC proves message integrity and possession of the shared secret. It does not identify a person by itself unless key management binds that secret to an identity.
Is HMAC-SHA-256 secure?
Yes, HMAC-SHA-256 remains a strong default when keys are high entropy, kept secret, and generated for authentication rather than reused from unrelated purposes.
How is HMAC used in JWT or JWS?
JWS algorithms such as HS256, HS384, and HS512 compute an HMAC over the encoded header and payload. Verifiers must enforce the expected algorithm and use the correct shared secret before trusting claims.
How is HMAC different from a plain hash?
A plain hash only detects accidental changes if the expected digest is trusted. HMAC mixes in a secret key, so attackers cannot recompute a valid tag after tampering.
Should HMAC be compared with normal string equality?
Use a constant-time comparison routine from a trusted library. Early-exit comparisons can leak how much of a tag matched through timing behavior.
References
Explore authoritative guidance and frameworks related to hash-based message authentication code (hmac).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.