Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

The Keyed-Hash Message Authentication Code (HMAC)



Quynh H. Dang


This Standard describes a keyed-hash message authentication code (HMAC), a mechanism for message authentication using cryptographic hash functions. HMAC can be used with any iterative Approved cryptographic hash function, in combination with a shared secret key. [Supersedes FIPS 198 (March 2002):]
Federal Inf. Process. Stds. (NIST FIPS) - 198-1
Report Number


computer security, cryptography, HMAC, MAC, message authentication, Federal Information Processing Standards (FIPS)


Dang, Q. (2008), The Keyed-Hash Message Authentication Code (HMAC), Federal Inf. Process. Stds. (NIST FIPS), National Institute of Standards and Technology, Gaithersburg, MD, [online], (Accessed April 21, 2024)
Created July 16, 2008, Updated November 10, 2018