HMAC vs Hash: What Is the Difference?
Understand when to use a plain hash versus HMAC for authentication and integrity.
Both hashes and HMACs produce fixed-length digests, but they serve different security purposes. A hash verifies integrity. An HMAC verifies both integrity and authenticity.
When to use a hash
- Checking file integrity (checksums)
- Storing passwords (with bcrypt/argon2, not plain SHA)
- Deduplication and fingerprinting
- Blockchain and Merkle trees
When to use HMAC
- API request signing (Stripe, AWS, webhooks)
- JWT token signing
- Verifying message authenticity with a shared secret
- Cookie signing in web frameworks