A hash proves data wasn’t changed — but anyone can recompute it, so it can’t prove WHO sent it. HMAC fixes that by folding a secret KEY into the hashing, twice (inner then outer). The result is a tag that only someone with the key could have produced, so a receiver who shares the key knows the message is authentic AND untampered. It authenticates every API request and secure cookie. Slide to change the key or message and watch the tag scramble.
A Message Authentication Code proves both INTEGRITY and AUTHENTICITY: HMAC(K,m)=H((K⊕opad) ‖ H((K⊕ipad) ‖ m)) nests the hash twice around the key with two distinct pads, so only a holder of the secret K can produce the valid tag — a plain hash can’t, since anyone can recompute it. The nested construction is provably secure given a reasonable compression function and resists length-extension attacks that bare H(K‖m) suffers. It authenticates API requests, JWTs, cookies, and TLS records. A fail-loud self-check throws unless the tag is deterministic yet changes under any key or message edit. ◆ real cryptography, node-verified.
Illustrated with a TOY 32-bit hash for visibility — the HMAC CONSTRUCTION (ipad/opad nesting) is standard, but real security needs a real hash (SHA-256); a MAC gives authenticity, not confidentiality, and both sides share the key (not public-key). The key/message sensitivity is exact.