API reference

Hash

Digest data with one or more hash algorithms.

GET POST /api/hash MCP tool hash

Computes MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, BLAKE2b-512, BLAKE3 digests of the data. MD5 and SHA-1 are broken for collision resistance: use them only to match existing checksums. HMAC is deliberately not offered by the API, because it needs a secret key and this server never accepts secrets; compute HMACs on the page, which runs locally.

Browser version (runs locally): Hash Generator.

Try it
Credentials
Remember these credentials

Not saved: you will paste them again next time.

No credentials yet? Get a client ID and secret. They are sent only to this site, in an Authorization: Basic header.

POST /api/hash with a JSON body

Parameters

Parameter Type Default Description
input string — Data as UTF-8 text. Use exactly one of input, input_base64, or a file upload.
input_base64 string — Data as Base64 (either alphabet), for binary content over JSON or MCP.
algorithm list of all | md5 | sha1 | sha256 | sha384 | sha512 | sha3-256 | sha3-512 | blake2b | blake3 all Comma-separated algorithm IDs, or all. IDs: md5, sha1, sha256, sha384, sha512, sha3-256, sha3-512, blake2b, blake3.
encoding hex | base64 hex Digest output encoding: lowercase hex or standard Base64 with padding.

Also accepted on every endpoint: format (json | text). Parameters may come from the query string, a JSON object body, an urlencoded or multipart form, or (for input) a text/plain body. Binary data can be uploaded as a multipart file field or an application/octet-stream body.

Global parameters
Parameter Type Default Description
format json | text json json returns the documented object. text returns only the primary value as text/plain (see "Text output").

Response 200 application/json

Field Type Description
bytes integer Length of the hashed data in bytes.
encoding "hex" | "base64" Encoding of the values in hashes.
hashes map of string Digest per algorithm ID, in request order.

Text output (format=text, text/plain): With one algorithm, the bare digest. With several, one <id> <digest> line per algorithm.

Errors

Errors are JSON: {"error": "<message>", "code": "<code>", "param": "<name>"?}.

Status Code When
400 invalid_parameter More than one data source is given.
400 missing_parameter A required parameter is absent.
400 unknown_parameter A parameter name is not in the table above (typos are rejected, not ignored).
413 payload_too_large The request body exceeds 1 MiB.
405 method_not_allowed A method other than GET, POST or OPTIONS.

Behaviour

  • Idempotent: the same arguments always return the same result.
  • Requires a client ID and secret (authentication). Each call is recorded as one metadata row against your client ID; inputs and outputs are never stored or logged. Responses carry cache-control: no-store.
  • CORS: any origin may call this endpoint from a browser, using your credentials.

Examples

Responses below were produced by running each request through this code at build time. Long strings are shortened.

One digest of text

curl 'https://util.caruana.me/api/hash?input=hello&algorithm=sha256'

Response 200

{
  "bytes": 5,
  "encoding": "hex",
  "hashes": {
    "sha256": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
  }
}
Same call as an MCP tools/call
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "hash",
    "arguments": {
      "input": "hello",
      "algorithm": [
        "sha256"
      ]
    }
  }
}

Several algorithms

curl 'https://util.caruana.me/api/hash?input=abc&algorithm=md5%2Csha256%2Cblake3'

Response 200

{
  "bytes": 3,
  "encoding": "hex",
  "hashes": {
    "md5": "900150983cd24fb0d6963f7d28e17f72",
    "sha256": "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
    "blake3": "6437b3ac38465133ffb63b75273a8db548c558465d79db03fd359c6cd5bd9d85"
  }
}
Same call as an MCP tools/call
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "hash",
    "arguments": {
      "input": "abc",
      "algorithm": [
        "md5",
        "sha256",
        "blake3"
      ]
    }
  }
}

Binary data as Base64, SRI-style Base64 output

curl -X POST 'https://util.caruana.me/api/hash' \
  -H 'content-type: application/json' \
  -d '{"input_base64":"AAECAw==","algorithm":["sha384"],"encoding":"base64"}'

Response 200

{
  "bytes": 4,
  "encoding": "base64",
  "hashes": {
    "sha384": "gK5DLnV4JgJQlcofpPicBsi6Z1Sx2IOo4xoeZfz7ggvXSs+so9k5pXTqQIp0Fi0d"
  }
}
Same call as an MCP tools/call
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "hash",
    "arguments": {
      "input_base64": "AAECAw==",
      "algorithm": [
        "sha384"
      ],
      "encoding": "base64"
    }
  }
}