Question 1

What is HMAC?

Accepted Answer

HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to produce a message authentication code. Unlike a plain hash, HMAC verifies both data integrity (the message was not altered) and authenticity (it came from someone with the secret key).

Question 2

What is HMAC-SHA256 used for?

Accepted Answer

HMAC-SHA256 is used in JWT signatures (HS256 algorithm), API request signing (AWS Signature Version 4, Stripe webhooks), TOTP two-factor authentication (RFC 6238), and verifying webhook payloads to ensure they came from a trusted source.

Question 3

Is HMAC the same as a digital signature?

Accepted Answer

Similar purpose, different mechanism. HMAC uses a shared secret key (symmetric) — both sender and receiver must have the same key. Digital signatures (RSA, ECDSA) use asymmetric key pairs — private key signs, public key verifies. HMAC is faster; digital signatures provide non-repudiation.

HMAC-SHA256-Generator

Eingabe

HMAC-SHA256

Häufige Fragen