Cryptography
Built-in step · 4 steps
Hash text, sign it with a secret or a private key, and generate random secrets.
Steps
| Step | What it does |
|---|---|
| Generate a random secret | Make a random string from a secure source of randomness, for an API key, a password, a signing secret, a one-time code or a token to put in a link. |
| Hash text | Turn text into a fixed-length fingerprint with SHA-256, SHA-512, MD5 or another hash. |
| Sign text with a private key | Create a digital signature for text with an RSA, EC (ECDSA) or Ed25519 private key, as a JWT, a Google service account or a signed URL needs. |
| Sign text with a secret (HMAC) | Compute an HMAC: a hash of the text keyed with a shared secret, the way webhooks and API requests are signed. |
Generate a random secret
Make a random string from a secure source of randomness, for an API key, a password, a signing secret, a one-time code or a token to put in a link.
Inputs
- Length
lengthnumber - How many characters, 1 to 1024. 32 hexadecimal characters hold 128 bits of randomness, plenty for an API key; a one-time code is usually 6 digits.From 1 to 1024. Default:
32. - Characters
formattext - What the secret is made of.One of:
hex(Hexadecimal digits (0-9, a-f)),letters_digits(Letters and digits),digits(Digits only (a one-time code)),base64(URL-safe Base64 (letters, digits, - and _)). Default:hex.
Outputs
A random string of the chosen length and characters, different every time.
Example output
"85538c0d682996d92cbf4f972e171d30"Hash text
Turn text into a fixed-length fingerprint with SHA-256, SHA-512, MD5 or another hash. The same text always gives the same hash and nothing can be read back from it, so it works for checksums, spotting duplicates, and comparing values without storing them.
Inputs
- Text
texttextRequired - The text to hash.
- Algorithm
algorithmtext - The hash to use. SHA-256 is what nearly every API asks for; MD5 and SHA-1 suit checksums and older services but are not safe against tampering.One of:
sha256(SHA-256),sha512(SHA-512),sha384(SHA-384),sha1(SHA-1),md5,sha3_256(SHA3-256),sha3_384(SHA3-384),sha3_512(SHA3-512). Default:sha256. - Write it as
encodingtext - How the hash is written: hexadecimal (the usual form), Base64, or URL-safe Base64 without padding.One of:
hex(Hexadecimal (a1b2c3…)),base64,base64url(Base64, URL-safe (no padding)). Default:hex.
Outputs
The hash, written in the chosen encoding: 64 hexadecimal characters for SHA-256.
Example output
"64ec88ca00b268e5ba1a35678a1b5316d212f4f366b2477232534a8aeca37f3c"Sign text with a private key
Create a digital signature for text with an RSA, EC (ECDSA) or Ed25519 private key, as a JWT, a Google service account or a signed URL needs. Anyone with the matching public key can check the signature; only the private key can make it.
Inputs
- Text
texttextRequired - The text to sign.
- Private key
private_keytextRequired - The private key in PEM form, from -----BEGIN PRIVATE KEY----- to -----END PRIVATE KEY-----, without a passphrase. Write @secrets.NAME to use a workspace secret rather than pasting it here.
- Hash
algorithmtext - The hash the signature is built on. An RSA key signs with PKCS#1 v1.5 (RS256 for SHA-256), an EC key with ECDSA (ES256), written the way OpenSSL writes it, or the way a JWT carries it when the text is a JWT's header and claims; an Ed25519 key ignores this choice.One of:
sha256(SHA-256 (RS256, ES256)),sha384(SHA-384 (RS384, ES384)),sha512(SHA-512 (RS512, ES512)),sha1(SHA-1 (older APIs)). Default:sha256. - Write it as
encodingtext - How the signature is written: Base64 (the usual form), URL-safe Base64 without padding (what a JWT needs), or hexadecimal.One of:
base64,base64url(Base64, URL-safe (no padding, for a JWT)),hex(Hexadecimal (a1b2c3…)). Default:base64.
Outputs
The signature, written in the chosen encoding. Its length follows the key: 344 Base64 characters for a 2048-bit RSA key, 86 for Ed25519.
Example output
"0Aye1Txt+wXjtWF0ZKR+JxneI/znQyE+otnmQJKhb4Sv2s4RhBmnjixZHuwaiheeln7FRCL8yYcFsEpANOJuCA=="Sign text with a secret (HMAC)
Compute an HMAC: a hash of the text keyed with a shared secret, the way webhooks and API requests are signed. Only someone who knows the secret can produce it, so use it to sign what you send, or recompute it to check a signature you received.
Inputs
- Text
texttextRequired - The text to sign, such as a request body.
- Secret
secrettextRequired - The shared secret. Write @secrets.NAME to use a workspace secret rather than pasting it here.
- Algorithm
algorithmtext - The hash the HMAC is built on. Most services use SHA-256; a few older ones use SHA-1.One of:
sha256(SHA-256),sha512(SHA-512),sha384(SHA-384),sha1(SHA-1),md5,sha3_256(SHA3-256),sha3_384(SHA3-384),sha3_512(SHA3-512). Default:sha256. - Write it as
encodingtext - How the HMAC is written: hexadecimal (the usual form), Base64, or URL-safe Base64 without padding. Match what the service you are talking to expects.One of:
hex(Hexadecimal (a1b2c3…)),base64,base64url(Base64, URL-safe (no padding)). Default:hex.
Outputs
The HMAC, written in the chosen encoding: 64 hexadecimal characters for SHA-256.
Example output
"0d5548fb7450e619b0753725068707519ed41cd212b0500bc20427e3ef66e08e"