Simon Willison’s Weblog

Don't Hash Secrets. A well written explanation from 2008 of why you must use hmac instead of raw SHA-1 when hashing against a secret.

Posted 24th January 2010 at 1:30 pm

Recent articles

The evolution of OpenAI's mission statement - 13th February 2026
Introducing Showboat and Rodney, so agents can demo what they’ve built - 10th February 2026
How StrongDM's AI team build serious software without even looking at the code - 7th February 2026

cryptography 24 hmac 2 security 575 sha1 4 signing 6

Monthly briefing

Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.

Pay me to send you less!

Sponsor & subscribe