[{"data":1,"prerenderedAt":207},["ShallowReactive",2],{"blog-hmac-complete-guide":3},{"id":4,"title":5,"author":6,"body":7,"category":189,"description":190,"extension":191,"image":192,"keywords":193,"meta":199,"navigation":200,"path":201,"publishedAt":202,"readingTime":203,"seo":204,"stem":205,"updatedAt":202,"__hash__":206},"blog\u002Fblog\u002Fhmac-complete-guide.md","HMAC哈希消息认证完全指南：验证数据完整性","91AI工具",{"type":8,"value":9,"toc":168},"minimark",[10,20,27,32,36,65,68,76,82,88,94,97,101,104,108,111,115,118,122,125,128,139,142,146,149,153,161,165],[11,12,13,14,19],"p",{},"接口调用中如何确保请求参数没被篡改？下载文件如何确认来源可信？HMAC哈希消息认证是常用方案。91AI工具的",[15,16,18],"a",{"href":17},"\u002Ftools\u002Fhmac","HMAC生成工具","帮你快速计算HMAC认证码。",[11,21,22],{},[23,24],"img",{"alt":25,"src":26},"HMAC工具界面","\u002Fimages\u002Ftools\u002Fhmac.png",[28,29,31],"h2",{"id":30},"在线hmac生成工具","在线HMAC生成工具",[33,34,35],"h3",{"id":35},"核心功能",[37,38,39,47,53,59],"ul",{},[40,41,42,46],"li",{},[43,44,45],"strong",{},"生成HMAC认证码","：基于文本内容和密钥计算HMAC值",[40,48,49,52],{},[43,50,51],{},"多种哈希算法","：支持MD5、SHA1、SHA256、SHA512等底层算法",[40,54,55,58],{},[43,56,57],{},"密钥参与计算","：认证码同时依赖消息内容和密钥，未掌握密钥无法伪造",[40,60,61,64],{},[43,62,63],{},"纯前端处理","：计算在浏览器本地完成，不上传服务器",[33,66,67],{"id":67},"使用步骤",[11,69,70,73,74],{},[43,71,72],{},"第一步","：打开",[15,75,18],{"href":17},[11,77,78,81],{},[43,79,80],{},"第二步","：输入待认证的消息内容和密钥",[11,83,84,87],{},[43,85,86],{},"第三步","：选择哈希算法（如SHA256），生成HMAC认证码",[11,89,90,93],{},[43,91,92],{},"第四步","：把认证码随消息一起发送，接收方用相同密钥重新计算比对",[28,95,96],{"id":96},"应用场景",[33,98,100],{"id":99},"场景一接口api签名","场景一：接口API签名",[11,102,103],{},"开放接口要求调用方用密钥对请求参数计算HMAC，服务端用相同密钥验证，防止请求被篡改，识别合法调用方。",[33,105,107],{"id":106},"场景二验证消息完整性","场景二：验证消息完整性",[11,109,110],{},"重要消息传输时附上HMAC认证码，接收方用约定密钥重新计算，一致则消息完整可信，不一致说明内容被改动。",[33,112,114],{"id":113},"场景三防止重放与伪造","场景三：防止重放与伪造",[11,116,117],{},"HMAC认证码由密钥保护，攻击者没有密钥无法伪造有效认证码，接口安全更有保障。",[33,119,121],{"id":120},"场景四理解认证码机制","场景四：理解认证码机制",[11,123,124],{},"实际生成和比对HMAC值，直观理解哈希消息认证码与普通哈希、数字签名的区别与联系。",[28,126,127],{"id":127},"注意事项",[37,129,130,133,136],{},[40,131,132],{},"HMAC不是加密，认证码无法还原消息内容，用于验证完整性和来源",[40,134,135],{},"密钥必须安全保管，密钥泄露等于认证码可被伪造",[40,137,138],{},"与普通哈希不同，HMAC需要密钥参与，安全性更高，可有效抵御伪造",[28,140,141],{"id":141},"常见问题",[33,143,145],{"id":144},"q-hmac和普通哈希有什么区别","Q: HMAC和普通哈希有什么区别？",[11,147,148],{},"普通哈希（如MD5、SHA256）只基于消息内容计算，任何人可算；HMAC额外使用密钥，只有掌握密钥的双方能生成和验证，安全性更强。",[33,150,152],{"id":151},"q-hmac能用于加密吗","Q: HMAC能用于加密吗？",[11,154,155,156,160],{},"不能。HMAC是消息认证码，用于验证消息完整性和身份，不具备加密解密能力。加密场景可参考",[15,157,159],{"href":158},"\u002Ftools\u002Faes-encrypt","AES加密","工具。",[33,162,164],{"id":163},"q-需要注册登录吗","Q: 需要注册登录吗？",[11,166,167],{},"不需要。纯前端工具完全免费，打开页面即可使用。",{"title":169,"searchDepth":170,"depth":170,"links":171},"",2,[172,177,183,184],{"id":30,"depth":170,"text":31,"children":173},[174,176],{"id":35,"depth":175,"text":35},3,{"id":67,"depth":175,"text":67},{"id":96,"depth":170,"text":96,"children":178},[179,180,181,182],{"id":99,"depth":175,"text":100},{"id":106,"depth":175,"text":107},{"id":113,"depth":175,"text":114},{"id":120,"depth":175,"text":121},{"id":127,"depth":170,"text":127},{"id":141,"depth":170,"text":141,"children":185},[186,187,188],{"id":144,"depth":175,"text":145},{"id":151,"depth":175,"text":152},{"id":163,"depth":175,"text":164},"crypto","HMAC完全指南，针对开发者在接口签名、数据完整性校验中验证消息未被篡改却不知如何使用的痛点，详解在线HMAC生成工具用法。介绍HMAC基于哈希算法加密钥生成消息认证码的原理、与普通哈希的区别，以及接口API签名防篡改、验证消息完整性的实操步骤，纯前端处理不上传服务器隐私安全，帮助开发者正确生成和校验HMAC认证码。","md","\u002Fog-image.png",[194,195,196,197,198],"HMAC","哈希消息认证","接口签名","数据完整性","消息认证码",{},true,"\u002Fblog\u002Fhmac-complete-guide","2026-08-04",5,{"title":5,"description":190},"blog\u002Fhmac-complete-guide","HHUaYU16Qb2T8NLrKCFNvZ6wq5uS9_Haz3F4uoJbqr4",1785817139965]