HMAC
Technology & Computing abbreviation · Cybersecurity
| Stands for | Hash-based message authentication code |
|---|---|
| Categories | Technology & Computing |
HMAC stands for Hash-based message authentication code, a cybersecurity abbreviation.
A widely used way to build a message authentication code from a cryptographic hash function such as SHA-256 and a secret key. Webhooks, API request signing and many JWTs use HMAC to prove messages are genuine.
Example: Stripe signs each webhook with HMAC-SHA256, so verify the signature before processing the event.
Usage notes
Designed by Mihir Bellare, Ran Canetti and Hugo Krawczyk in 1996 and standardized in RFC 2104 (1997) and FIPS 198. Its nested construction stays secure even with hash functions such as MD5 and SHA-1 that are broken for collisions, though modern systems use SHA-256. Signature comparisons should use constant-time functions to avoid timing attacks.
Related abbreviations
More cybersecurity abbreviations
- ECC – Elliptic-curve cryptography
- ECDSA – Elliptic Curve Digital Signature Algorithm
- EDR – Endpoint detection and response
- FIDO – Fast Identity Online
- GPG – GNU Privacy Guard
- GRC – Governance, risk and compliance
- HSM – Hardware security module
- HSTS – HTTP Strict Transport Security
- IAM – Identity and access management
- IDS – Intrusion detection system
- IoC – Indicator of compromise
- IPS – Intrusion prevention system