Hash Generator API
Compute MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 of text or files in one call, as hex or base64, with optional HMAC signing.
The Hash API computes checksums and cryptographic digests of a string or a file. By default it returns all supported algorithms at once – MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 – or only the ones you list in algorithm (comma separated, e.g. sha256,md5).
Send the input as text (query or JSON), as a raw text body, or hash binary data: upload a file in the multipart field file, post the raw bytes, or pass base64 in file_base64. Files can be as large as your plan allows (Free 5 MB, Starter 20 MB, Pro 50 MB). The response also reports the number of bytes hashed.
Set hmac_key to get HMAC signatures instead of plain digests (HMAC-SHA256 is what most webhook providers use), and encoding=base64 for base64 output instead of hex. CRC32 is always returned as 8 hex characters.
Parameters
| Name | In | Type | Required | Default | |
|---|---|---|---|---|---|
text | body|query | string | yes | Text to hash (UTF-8). Not needed when a file or a raw text body is sent. | |
file | body | file | no | File to hash: multipart field file, raw binary body, or base64 in file_base64. Max 5/20/50 MB by plan. | |
algorithm | body|query | string | no | all | all or a comma-separated list of md5, sha1, sha256, sha384, sha512, crc32 (alias algorithms). |
encoding | body|query | string | no | hex | hex or base64 (CRC32 is always hex). |
hmac_key | body|query | string | no | Secret key: returns HMAC signatures instead of plain hashes. |
Example
curl -X POST "https://apibox.io.vn/v1/hash" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"hello world"}'const res = await fetch('https://apibox.io.vn/v1/hash', {
method: 'POST',
headers: {
Authorization: 'Bearer YOUR_API_KEY',
'Content-Type': 'application/json',
},
body: JSON.stringify({
"text": "hello world"
}),
});
const data = await res.json();
console.log(data);import requests
res = requests.post(
"https://apibox.io.vn/v1/hash",
headers={"Authorization": "Bearer YOUR_API_KEY"},
json={"text": "hello world"},
timeout=30,
)
print(res.json())<?php
$ch = curl_init('https://apibox.io.vn/v1/hash');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
CURLOPT_POSTFIELDS => '{"text":"hello world"}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));Response
{
"encoding": "hex",
"bytes": 11,
"hashes": {
"md5": "5eb63bbbe01eeed093cb22bb8f5acdc3",
"sha1": "2aae6c35c94fcfb415dbe95f408b9ce91ee846ed",
"sha256": "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9",
"sha384": "fdbd8e75a67f29f701a4e040385e2e23986303ea10239211af907fcbb83578b3e417cb71ce646efd0819dd8c088de1bd",
"sha512": "309ecc489c12d6eb4cc40f50c902f2b4d0ed77ee511a7c7a9bcd3ca86d4cd86f989dd35bc5ff499670da34255b45b0cfd830e81f605dcf7dc5542e93ae9cd76f",
"crc32": "0d4a1185"
}
}Use cases
- Verify file integrity with SHA-256 checksums after upload or download
- Compute HMAC-SHA256 signatures to test webhook verification code
- Create cache keys or ETags from content
- Deduplicate uploaded files by their hash
FAQ
How do I compute an HMAC-SHA256 signature?
POST {"text": "payload", "algorithm": "sha256", "hmac_key": "your-secret"}. Add "encoding": "base64" if the provider expects base64 (Shopify, for example) instead of hex (GitHub, Stripe).
Can I hash a file instead of text?
Yes. Upload it as multipart field "file", send the raw bytes as the request body, or pass "file_base64" in JSON. The limit is your plan’s file size (5/20/50 MB).
Is MD5 still safe to use?
Not for passwords or signatures: MD5 and SHA-1 are broken against collisions. They are still fine for non-security checksums and legacy compatibility; use SHA-256 or SHA-512 for anything security related, and a slow KDF such as bcrypt or Argon2 for passwords.
Related APIs
Encode / Decode
Encode or decode text as Base64, Base64URL, hex, URL encoding, HTML entities, Unicode escapes, ROT13 or binary with one simple API call.
***Password Generator
Generate cryptographically secure random passwords (4–256 chars, up to 100 at once) or check a password’s strength, entropy and estimated crack time.
JWTJWT Decode & Sign
Decode any JWT, check expiry and verify its signature with a secret, PEM or JWK – or sign new tokens with HS256/384/512, RS, PS or ES algorithms.