+1 coinfor reading to the end
+1
Home / Glossary / HMAC
Glossary · Security

HMAC

Hashed Message Authentication Code

In plain language

A short code made from a message and a secret key, used to prove the message came from someone with the key and was not changed.

The metaphor

Like a wax seal pressed with a private signet ring: anyone can see it is intact, and only the ring owner can make a valid one.

Going deeper

How it works

  • The sender and receiver share a secret key.
  • The sender combines the key and the message to produce the code.
  • The receiver repeats the calculation and compares the results.
  • Authenticator-app codes and many web service requests use it.
In practice
  • An app verifies that a request really came from your payment provider.
  • A six-digit authenticator code is built with it.
  • A software system checks that a downloaded file was not changed.

A question owners ask

Do I need to know this?

No. It is part of how authenticator apps and web services check each other, and it works without any action from you.

Related terms
AAAAuthentication, Authorization, and AccountingAccount takeoverACLAccess Control ListAdmin accountAESAdvanced Encryption StandardAES-256Advanced Encryption Standards 256-bitAISAutomated Indicator SharingAPTAdvanced Persistent Threat

Something here sounds like your problem?

Every WILDCARD card exists to solve one named problem. Find yours.

Pick your problem →