HMAC

HMAC (Hash-based Message Authentication Code) wraps a hash function like SHA-256 with a shared secret key to produce an authentication tag that proves the message was not tampered with and came from someone holding the key. The construction (`H((K xor opad) || H((K xor ipad) || message))`) is provably secure even against length-extension attacks that break naive `H(K || message)` schemes. HMAC is everywhere: AWS request signing (SigV4), JWT HS256 tokens, webhook signatures (Stripe, GitHub), TLS record MACs in older cipher suites, and TOTP/HOTP one-time codes. The right primitive any time both sides share a secret and need to authenticate messages.