What is a Message Authentication Code (MAC), and what does it add over a plain hash?

Question

Accepted Answer

A MAC is a hash computed over the data plus a shared secret key — so only someone who knows the key can produce or verify it.
MAC = hash(data, key). Alice and Bob share a secret key in advance. Alice sends the data + MAC; Bob recomputes the MAC with the same key and compares.
Why Mallroy is stopped: she can alter the data, but without the key she can't compute a valid MAC for her forged version. So a MAC gives:

Integrity — tampering is detected.
Authenticity — the message came from someone holding the shared key.

The limitation: because the key is shared, Bob can't prove to a third party that Alice (not himself) created the MAC — both of them could have. That's why a MAC does not give non-repudiation.
Tip: Real MACs are HMAC (e.g. HMAC-SHA256). Think "hash with a password baked in."