hash_hmac computes an HMAC authentication tag for data using a secret key and a selected cryptographic hash algorithm.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: hash_hmac computes an HMAC authentication tag for data using a secret key and a selected cryptographic hash algorithm.
Part of core PHP or a normally bundled standard extension; check your deployment configuration.
Syntax and Return Value
hash_hmac(string $algo, string $data, string $key, bool $binary = ...): string| Parameter | Purpose |
|---|---|
| $algo (string) | The exact algorithm identifier supported by this API. |
| $data (string) | The input data bytes. Use the exact original bytes when verifying. |
| $key (string) | Raw key bytes in the required algorithm-specific length; protect them from disclosure. |
| $binary (bool) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: Authenticate with a secret key; hash_equals requires the known trusted value as its first argument and matching lengths are still observable.
Example 1: Basic Operation
Inspect the expected result: do not print secrets or reuse illustrative credentials in production.
<?php
$mac = hash_hmac("sha256", "invoice-42", "example-secret");
echo $mac;Example 2: A Different Use Case
Inspect the expected result: do not print secrets or reuse illustrative credentials in production.
<?php
// Check the alternative case.
$mac = hash_hmac("sha256", "approved-record", "example-secret");
echo $mac;Practical Example: Checking the Result
Inspect the expected result: do not print secrets or reuse illustrative credentials in production.
<?php
// Verify the expected behavior before using results.
$mac = hash_hmac("sha256", "new-session", "example-secret");
echo $mac;Important Behavior and Edge Cases
Authenticate with a secret key; hash_equals requires the known trusted value as its first argument and matching lengths are still observable.
Distinguish digest encoding from secret-key authentication and keep fixed-length expected authentication values for comparisons.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| hash_hmac | hash_hmac computes an HMAC authentication tag for data using a secret key and a selected cryptographic hash algorithm. |
| Related technique | Use HMAC to calculate a keyed digest, then hash_equals to compare the received and expected digests. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | Use HMAC to calculate a keyed digest, then hash_equals to compare the received and expected digests. |
| Ignoring a security prerequisite or failure case | Authenticate with a secret key; hash_equals requires the known trusted value as its first argument and matching lengths are still observable. |
Key Takeaways
- hash_hmac computes an HMAC authentication tag for data using a secret key and a selected cryptographic hash algorithm.
- Authenticate with a secret key; hash_equals requires the known trusted value as its first argument and matching lengths are still observable.
- Use HMAC to calculate a keyed digest, then hash_equals to compare the received and expected digests.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.