Hash and Encoding

API

Send a stateless request to POST /api/tools/hash-encoding. Input is UTF-8 text, limited to 1,000,000 characters. Operations are hash, hmac, encrypt, decrypt or <format>-encode / <format>-decode, where format is one of ascii85 | base32 | base64 | base64url | binary | decimal | hex | html | morse | octal | rot13 | unicode | url. Hash operations accept algorithm set to md5 | sha1 | sha224 | sha256 | sha384 | sha512 | sha512-224 | sha512-256 | sha3-224 | sha3-256 | sha3-384 | sha3-512 | blake2b512 | blake2s256 | ripemd160 | crc32. MD5, SHA-1, RIPEMD-160 and CRC32 are provided for checksums and compatibility only, not security.

curl -X POST https://oathompsonjones.co.uk/api/tools/hash-encoding \
  -H 'Content-Type: application/json' \
  -d '{
  "operation": "hash",
  "algorithm": "sha256",
  "text": "Hello, world!"
}'

Success responses contain { success: true, data: { output } }; failures use the shared structured error format. Decode operations return UTF-8 text and report invalid encoded data. Binary, octal and decimal use space-separated byte values. Encrypt and decrypt operations take cipher (atbash | caesar | vigenere | beaufort | affine | railfence | xor | aes256gcm) and, for every cipher except atbash, a key of at most 1000 characters. HMAC requests take algorithm (any hash except CRC32) and a required key, and return a hex signature. Keys and input are never stored or logged. Work per request is bounded by the input and key limits. Classical ciphers are not secure; only aes256gcm is suitable for protecting data. Encoding is reversible and not secret, hashing is one-way, HMAC is a keyed signature, and encryption needs its key. None of these is secure storage, and the tool is not a substitute for a reviewed production security design.