HMAC
Hash-based message authentication code
A tag computed from a message, a shared secret key and a cryptographic hash. Anyone holding the key can create valid tags, so a valid tag shows that some key holder produced the message, not which one.
- Defined in
- RFC 2104
Covered in
Verify webhook deliveries before acting
Verify the provider’s signature over the correct bytes, then apply replay, authorization, and idempotency controls before a business action.
Defend JWTs against forgery, confusion and replay
Verify a JWT as an issuer-, type- and audience-bound assertion with an algorithm allowlist and trusted keys, closing the alg "none", key-confusion, header-injection, weak-secret and replay attacks.
Choose cryptographic algorithms and parameters by job
A sourced quick reference for October 2026: which algorithm and parameters to use for encryption, hashing, passwords, MACs, signatures, key agreement, key derivation, randomness and TLS, the matching APIs in Node.js, Python, Java, Go and .NET, and where post-quantum migration stands.
Tokenization, pseudonymization and privacy transformations: choose deliberately
Choose between vault tokens, keyed pseudonyms, format-preserving encryption, aggregation and differential privacy by the joins, reversibility and leakage each allows, and test re-identification on the data you release.
Practice: Webhook signature and replay lab: Repair a webhook handler that pays twice · JWT verification lab: Verify a JWT before trusting it · Insecure randomness lab: Generate unguessable API keys