HMAC vs Hash: What Is the Difference?
Understand when to use a plain hash versus HMAC — and how Utiliio's Hash/HMAC workbench covers both.
Both hashes and HMACs produce fixed-length digests, but they serve different security purposes. A hash verifies integrity. An HMAC verifies both integrity and authenticity.
When to use a hash
- Checking file integrity (checksums)
- Comparing whether two strings produce the same digest
- Deduplication and fingerprinting
- Blockchain and Merkle trees — not for password storage (use bcrypt/argon2)
When to use HMAC
- API request signing (Stripe, AWS, webhooks)
- Verifying JWT HS256 signatures in the JWT workbench
- Cookie signing in web frameworks
- Any workflow needing a shared secret
One workbench, two tabs
Utiliio combines Hash and HMAC on one page with SHA-256, SHA-384, and SHA-512. Switch tabs without losing input — shareable links preserve algorithm and active tab.
Open Hash/HMAC workbench →Compare Utiliio vs online hash tools →