A hash turns data into a fixed-size fingerprint that anyone can recompute; it detects accidental change but proves nothing about who made it. An HMAC mixes a shared secret key into the hash, so only people holding the key can create or verify it: it proves integrity and that the sender knew the secret. A digital signature uses a private key to sign and a public key to verify, so anyone can check who signed it and the signer cannot later deny it.
At a glance
| Hash | HMAC | Digital signature | |
|---|---|---|---|
| Key needed | None | One shared secret | Private key to sign, public key to verify |
| Detects change | Yes | Yes | Yes |
| Proves who created it | No | Only to someone who shares the secret | Yes, to anyone with the public key |
| Non-repudiation | No | No (either side could have made it) | Yes |
| Speed | Very fast | Very fast | Slower |
| Typical use | Checksums, deduplication | API request signing, webhooks, HS256 tokens | Software signing, certificates, RS256/ES256 tokens |
The same message, three ways
For the message hello:
| Method | Result |
|---|---|
| SHA-256 hash | 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 |
HMAC-SHA256, key secret |
88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0b |
HMAC-SHA256, key other |
ccba5a99c3e0c7f2bc6c6f02bc752217c3c71fb91b41211dffc0c1d0981d1663 |
The hash is the same for everyone. The HMAC changes completely with the key, so without secret nobody can produce the second line. A digital signature of the same message would be produced with a private key and checked with the matching public key; an Ed25519 signature is always 64 bytes, and an RSA-2048 signature is 256 bytes.
Compute the first two with the Hash Generator and the HMAC Generator, and create a key pair for signatures with the Key Pair Generator.
Which should you choose?
- Check a download matches a published checksum: hash, published over a trusted channel (see How to Verify a File Checksum).
- Verify a webhook or API call between systems that share a secret: HMAC.
- Let anyone verify who published software or a document: digital signature.
- Store passwords: none of these directly; use a password hash, see MD5 vs SHA-256 vs bcrypt.
The background to the keys involved is in Symmetric vs Asymmetric Encryption, and How Hashing Works explains hashing in depth.