Node.js
HMAC
Learn HMAC with crypto.createHmac.
HMAC
HMAC (Hash-based Message Authentication Code) adds a key to a hash. Only those with the right key can verify the hash; so it is used for data integrity and authentication.
Example: crypto.createHmac("sha256", "key").update("data").digest("hex"). Here "key" is a symmetric secret shared by sender and receiver. The difference from createHash: a hash can be produced by anyone, an HMAC only by the key holder. It is common for webhook signing, JWT (JSON Web Token) and API request verification. The receiver computes the same HMAC with their key; if it matches, the data is untampered and from a trusted source. If the key leaks the HMAC is useless; so the key is kept in an environment variable.
HMAC verification
After producing an HMAC, to verify it the receiver computes the same hash with the same key and compares the two. If they match, the data is safe.
Example: const expected = crypto.createHmac("sha256", key).update(data).digest("hex"); if (expected === received) console.log("Valid");. For comparison crypto.timingSafeEqual is safer than ===; it prevents timing attacks. A timing attack leaks information from comparison duration. The HMAC key must be the same on both sides; if different, the hash differs. The key length should not be smaller than the algorithm's block size; for sha256 32 bytes is recommended. In production the key is read from process.env.HMAC_KEY.
Exercise Sign data with HMAC
Import with const crypto = require("node:crypto");. Sign with const hmac = crypto.createHmac("sha256", "anahtar").update("veri").digest("hex");. Print the length with console.log("HMAC length: " + hmac.length).
Show example solution
const crypto = require("node:crypto");
const hmac = crypto.createHmac("sha256", "anahtar").update("veri").digest("hex");
console.log("HMAC length: " + hmac.length);
Test yourself
-
How many parameters does createHmac take?
crypto.createHmac("sha256", "anahtar")
- 1: algoritma
- 3: algoritma, anahtar, veri
- 0: parametre yok
- 2: algoritma ve anahtar
Show answer
2: algoritma ve anahtar — createHmac takes two: algorithm and key.
-
Match each piece to its role
- createHmac
- Creates keyed hash
- key
- Shared secret
- update
- Feeds data
- timingSafeEqual
- Safe comparison
-
Complete the createHmac call
const hmac = crypto.____("sha256", "anahtar").update("veri").digest("hex");
Show answer
const hmac = crypto.createHmac("sha256", "anahtar").update("veri").digest("hex");
Next lesson: AES
