Why can HMAC authenticate a message while an unkeyed SHA-256 digest alone cannot?
HMAC encrypts the message so only the receiver can read it
HMAC is secure because the receiver keeps the hash algorithm secret
SHA-256 always produces the same digest even when the message changes
HMAC incorporates a shared secret key, so an attacker without the key cannot create the expected code for a modified message