HMAC explained | keyed hash message authentication code

In this video we cover what HMAC (keyed hash message authentication code) is and where it is used in the IT world. We also clarify the HMAC vs hash question and explain the two guarantees HMAC gives. HMAC provides integrity and authentication and is often used in JSON Web Tokens with the HS256 algorithm. To understand HMAC you need to understand what a hash function is. A hash function maps an arbitrary amount of input bits to an output bit vector of fixed length.

With HMAC you can use an arbitrary hashing function such as SHA256 and a secret.

[jgoebel]

What do you think about this video?
Was the explanation about HMAC clear?

[waelaltaqi]

Solid vid on hashing and HMAC ... one of the best vids I've seen on the topic period. Thanks!

[SabreToothGaming]

Great job explaining the pieces of a HMAC and the practical use cases. Thank you!

[MrJohn]

This was really helpful. The explanation was clear and concyse. Thank you

[romankovrigin]

The best explanation I have seen so far, thank you!

[captainnemonic]

Clear as newly Windexed glass! I found this helpful. Thanks for putting this out there.

[AlHoussem]

Well explained and good presentation, Thanks

[message]

the best explanation that I could find & way better than in my script
thank you for the effort :)

[ABLyonary]

Great explanation but sometime I notice in these videos is that no actual practical examples are shown. It would be cool to actually see it in action

[akhileshgupta]

Thanks for a simple and clear explanation!
here is a question I have, would appreciate your response:
HMAC looks quite similar to a signed data. only difference i see is with signed data hash is encrypted by a ASYM private key and in HMAC there is rather a secret key known to both parties used!

[aghiadalzein]

Great video, simple and directly into the point thanks a lot.

[hemantmadan]

very clear and very precise...really liked it!!

[binr_]

Explanation made sense Helped me to undersand HMAC better Thank your for the Tutorial

[maciejwodecki]

Thanks man. Very clear explanation. This is what I was looking for.

[ricp]

Great explanation, to the point. Thanks

[Alex-nquh]

Useful explanation- thank you very much

[RandomAlias]

well deserved subscribe.. Great explanation. Well done sir

[michaelulloa]

Exactly what I was looking for, thank you!

[siddharthjain]

This is very helpful. I have a rudimentary question. The difference between the Hash function and HMAC is the secret. The output for both is fixed. Then in the example what additional security does that key provide. Because is HMAC is changed when Hello World changes to Hello Bob. Won't also the Hash function output change in that case? And even then Bob would know that the message has been tampered with. Additionally, in case of HMAC when Bob gets the hacked message, is he also getting the HMAC output, which I am assuming is not tampered, to compare it against his own calculation of HMAC?

[janithmalinga]

This is really good explanation, Thanks