🔐 Encryption & Hashing Utility API

A universal cryptography utility for developers. Supports hashing, encryption, decryption, key generation, HMAC, JWT, encoding and BYOK threat lookups with multiple algorithms. Built for easy GET/POST integration in apps.

📅 Version

v0.0.2 — Released August 28, 2026

New in this release: dedicated endpoints for hashing, encryption, key generation, HMAC, JWT, encoding and BYOK external lookups (Have I Been Pwned, VirusTotal). The legacy /crypto endpoint still works.

🌍 Base URL

encryption-hashing-utility-api.p.rapidapi.com

⚡ Endpoints

`GET /status`

Health check. Returns API name, version, uptime and current UTC time.

Param	Type	Required	Description
—	—	—	No parameters

Example

GET /status

Response

{
  "ok": true,
  "name": "Encryption & Hashing Utility API",
  "version": "v0.0.2",
  "uptime_seconds": 1234.5,
  "time": "2026-08-28T09:00:00Z"
}

`POST /hash`

Hash any text with 19 algorithms: SHA-1/SHA-2/SHA-3, MD5, BLAKE2, RIPEMD-160, CRC32/Adler32 checksums, and secure password hashes (bcrypt, argon2, scrypt, PBKDF2).

Param	Type	Required	Description
`text`	string	✅ Yes	The data to hash.
`algo`	string	✅ Yes	One of: `sha1`, `sha224`, `sha256`, `sha384`, `sha512`, `sha3-224`, `sha3-256`, `sha3-384`, `sha3-512`, `md5`, `blake2b`, `blake2s`, `ripemd160`, `crc32`, `crc32c`, `adler32`, `bcrypt`, `argon2`, `scrypt`, `pbkdf2`.
`rounds`	int	❌ No	bcrypt cost factor. Default: `12`.
`salt`	string	❌ No	Base64 salt for `scrypt` / `pbkdf2`. Random if omitted.
`iterations`	int	❌ No	PBKDF2 iterations. Default: `100000`.
`digest`	string	❌ No	PBKDF2 digest (`sha1`, `sha256`, `sha512`). Default: `sha256`.
`n`,`r`,`p`	int	❌ No	scrypt params. Defaults: `16384`, `8`, `1`.

Example

POST /hash
{
  "text": "hello world",
  "algo": "sha256"
}

Response

{
  "algorithm": "sha256",
  "result": "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"
}

Example — Password Hash (bcrypt)

POST /hash
{
  "text": "mypassword",
  "algo": "bcrypt",
  "rounds": 10
}

Response

{
  "algorithm": "bcrypt",
  "result": "$2b$10$9ZxNYjy2SrLMfglfN173EuCFYXPSPBDwslwyNdwybIybzogHn8te."
}

Example — Key Derivation (scrypt)

POST /hash
{
  "text": "mypassword",
  "algo": "scrypt"
}

Response

{
  "algorithm": "scrypt",
  "result": "3f24780d883ad2c937ba530553fa97a5...",
  "salt": "t92n4puQNcbvlBPysv92yg==",
  "params": { "n": 16384, "r": 8, "p": 1 }
}

`POST /hash/verify`

Verify a bcrypt or argon2 hash against a plaintext password. Ideal for login flows.

Param	Type	Required	Description
`text`	string	✅ Yes	The plaintext to check.
`algo`	string	✅ Yes	One of: `bcrypt`, `argon2`.
`hash`	string	✅ Yes	The stored hash to verify against.

Example

POST /hash/verify
{
  "text": "mypassword",
  "algo": "argon2",
  "hash": "$argon2id$v=19$m=65536,t=3,p=4$..."
}

Response

{
  "algorithm": "argon2",
  "verified": true
}

`POST /hmac`

Sign a message with an HMAC key (SHA-1/224/256/384/512). Use for API request signing, webhook validation and message integrity.

Param	Type	Required	Description
`text`	string	✅ Yes	The message to sign.
`key`	string	✅ Yes	HMAC secret key.
`algo`	string	❌ No	One of: `sha1`, `sha224`, `sha256`, `sha384`, `sha512`. Default: `sha256`.

Example

POST /hmac
{
  "text": "message",
  "key": "secret",
  "algo": "sha256"
}

Response

{
  "algorithm": "sha256",
  "result": "8b5f48702995c1598c573db1e21866a9b825d4a794d169d7060a03605796360b"
}

`POST /encrypt`

Encrypt text with 5 ciphers: AES-CBC, AES-GCM (authenticated), ChaCha20, Blowfish and RSA-OAEP. Returns base64 ciphertext plus the iv / nonce / tag needed for decryption.

Param	Type	Required	Description
`text`	string	✅ Yes	Plaintext to encrypt.
`algo`	string	✅ Yes	One of: `aes-cbc`, `aes-gcm`, `chacha20`, `blowfish`, `rsa` (aliases: `aes`, `aes256`).
`key`	string	✅ Yes	Symmetric key (any string, normalized to cipher size) or PEM public key for RSA.

Example — AES-GCM (recommended, authenticated)

POST /encrypt
{
  "text": "secret data",
  "algo": "aes-gcm",
  "key": "mysecretkey123"
}

Response

{
  "algorithm": "AES-GCM",
  "result": {
    "ciphertext": "dQmpD2zuCEA=",
    "nonce": "YIpfsm2fZMzSH2fi3gH9ew==",
    "tag": "id6eLlLQpC/jc+0zdemNew==",
    "mode": "GCM"
  }
}

Example — AES-CBC

POST /encrypt
{
  "text": "secret data",
  "algo": "aes-cbc",
  "key": "mysecretkey123"
}

Response

{
  "algorithm": "AES-CBC",
  "result": {
    "ciphertext": "4tD5a8l1oG+Q6...",
    "iv": "jhs78J9n0sdh==",
    "mode": "CBC"
  }
}

Example — RSA

POST /encrypt
{
  "text": "hidden message",
  "algo": "rsa",
  "key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkq...\n-----END PUBLIC KEY-----"
}

Response

{
  "algorithm": "RSA",
  "result": {
    "ciphertext": "Lk23a9hdJd+Skj2..."
  }
}

`POST /decrypt`

Decrypt ciphertext produced by /encrypt (AES-CBC, AES-GCM, ChaCha20, Blowfish, RSA). AES-GCM verifies authenticity and rejects tampered data.

Param	Type	Required	Description
`algo`	string	✅ Yes	One of: `aes-cbc`, `aes-gcm`, `chacha20`, `blowfish`, `rsa`.
`key`	string	✅ Yes	Same key used to encrypt, or PEM private key for RSA.
`ciphertext`	string	✅ Yes	Base64 ciphertext from `/encrypt`.
`iv`	string	⚠️ Depends	Required (Base64) for `aes-cbc` and `blowfish`.
`nonce`	string	⚠️ Depends	Required (Base64) for `aes-gcm` and `chacha20`.
`tag`	string	⚠️ Depends	Required (Base64) for `aes-gcm`.

Example

POST /decrypt
{
  "algo": "aes-gcm",
  "key": "mysecretkey123",
  "ciphertext": "dQmpD2zuCEA=",
  "nonce": "YIpfsm2fZMzSH2fi3gH9ew==",
  "tag": "id6eLlLQpC/jc+0zdemNew=="
}

Response

{
  "algorithm": "AES-GCM",
  "result": "secret data"
}

`POST /rsa/keys`

Generate a fresh RSA key pair (1024–4096 bit) as PEM. Returns both private and public keys.

Param	Type	Required	Description
`bits`	int	❌ No	One of: `1024`, `2048`, `3072`, `4096`. Default: `2048`.

Example

POST /rsa/keys
{
  "bits": 2048
}

Response

{
  "algorithm": "RSA",
  "bits": 2048,
  "private_key": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----",
  "public_key": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----"
}

`POST /keys`

Generate AES symmetric keys (hex + base64), random bytes, or URL-safe API secret tokens.

Param	Type	Required	Description
`type`	string	✅ Yes	One of: `aes`, `aes256`, `aes128`, `bytes`, `random`, `secret`, `api_key`.
`size`	int	❌ No	Size in bytes for `aes` / `bytes`. Default: `32`.
`length`	int	❌ No	Character length for `secret` / `api_key`. Default: `32`.

Example

POST /keys
{
  "type": "aes"
}

Response

{
  "type": "aes",
  "size": 32,
  "key_hex": "850d56ee701aea818f736e355afe16d84eb7069794dcbf684dcd4d56fdb7355a",
  "key_base64": "hQ1W7nAa6oGPc241Wv4W2E63BpeU3L9oTc1NVv23NVo="
}

`POST /password`

Generate a cryptographically strong random password, guaranteed to contain lowercase, uppercase and digits (plus symbols if enabled).

Param	Type	Required	Description
`length`	int	❌ No	Length 4–128. Default: `20`.
`symbols`	bool	❌ No	Include symbols. Default: `true`.

Example

POST /password
{
  "length": 16,
  "symbols": true
}

Response

{
  "length": 16,
  "result": "6?9t_Qa;Y?1kry,[",
  "symbols": true
}

`GET /uuid`

Generate a UUID v4 (random) or v1 (time-based).

Param	Type	Required	Description
`version`	string	❌ No	One of: `4`, `1`. Default: `4`.

Example

GET /uuid?version=4

Response

{
  "version": "4",
  "result": "2ae5a0c1-0315-49a9-92cd-fdece27f048b"
}

`POST /encode/base64`

Encode any text to base64.

Param	Type	Required	Description
`text`	string	✅ Yes	Text to encode.

Example

POST /encode/base64
{
  "text": "hello world"
}

Response

{
  "encoding": "base64",
  "result": "aGVsbG8gd29ybGQ="
}

`POST /decode/base64`

Decode a base64 string back to text.

Param	Type	Required	Description
`text`	string	✅ Yes	Base64 to decode.

Example

POST /decode/base64
{
  "text": "aGVsbG8gd29ybGQ="
}

Response

{
  "encoding": "base64",
  "result": "hello world"
}

`POST /encode/url`

Percent-encode a string for safe use in URLs and query strings.

Param	Type	Required	Description
`text`	string	✅ Yes	Text to encode.

Example

POST /encode/url
{
  "text": "a b&c=d"
}

Response

{
  "encoding": "url",
  "result": "a%20b%26c%3Dd"
}

`POST /decode/url`

Decode a percent-encoded string back to readable text.

Param	Type	Required	Description
`text`	string	✅ Yes	Encoded string.

Example

POST /decode/url
{
  "text": "a%20b%26c%3Dd"
}

Response

{
  "encoding": "url",
  "result": "a b&c=d"
}

`POST /jwt/encode`

Create a signed JWT (HS256/HS384/HS512) from any JSON payload — for auth tokens, session tokens and API keys.

Param	Type	Required	Description
`payload`	object	✅ Yes	JSON object to embed in the token.
`secret`	string	✅ Yes	HMAC signing secret.
`algo`	string	❌ No	One of: `HS256`, `HS384`, `HS512`. Default: `HS256`.

Example

POST /jwt/encode
{
  "payload": {
    "user": "dakid",
    "role": "admin"
  },
  "secret": "s3cret",
  "algo": "HS256"
}

Response

{
  "algorithm": "HS256",
  "result": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZGFraWQiLCJyb2xlIjoiYWRtaW4ifQ.Mc0J6lOOZEfuvlfwVQjoHt60cCc3uFKKJpXn0N_r5J8"
}

`POST /jwt/decode`

Verify a JWT signature and decode its payload. Returns an error for wrong secrets, expired or tampered tokens.

Param	Type	Required	Description
`token`	string	✅ Yes	The JWT to decode.
`secret`	string	✅ Yes	Secret used to sign the token.

Example

POST /jwt/decode
{
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "secret": "s3cret"
}

Response

{
  "payload": {
    "user": "dakid",
    "role": "admin"
  }
}

`POST /external/pwned`

Check if a password has appeared in known data breaches via Have I Been Pwned. Uses k-anonymity — only the first 5 characters of the SHA-1 hash leave your device; the password itself is never transmitted. BYOK: supply your own X-Hibp-Api-Key header (optional — works keyless).

Param	Type	Required	Description
`password`	string	✅ Yes	Password to check.
`X-Hibp-Api-Key`	header	✅ Yes	Your HIBP key (for premium rate limits).

Example

POST /external/pwned
{
  "password": "password123"
}

Response

{
  "service": "Have I Been Pwned",
  "sha1_prefix": "CBFDA",
  "breached": true,
  "occurrences": 2266543,
  "key_used": false,
  "message": "Password appears 2266543 time(s) in known breaches."
}

`POST /external/virustotal`

Look up the malware reputation of a file hash (MD5/SHA1/SHA256) in VirusTotal's database. Returns detection stats and a permalink. BYOK: requires your own X-Virustotal-Api-Key header.

Param	Type	Required	Description
`resource`	string	✅ Yes	MD5/SHA1/SHA256 file hash (alias: `hash`).
`X-Virustotal-Api-Key`	header	✅ Yes	Your VirusTotal API key.

Example

POST /external/virustotal
{
  "resource": "d41d8cd98f00b204e9800998ecf8427e"
}

Response

{
  "service": "VirusTotal",
  "found": true,
  "sha256": "...",
  "md5": "...",
  "sha1": "...",
  "reputation": 0,
  "meaningful_name": "file.exe",
  "last_analysis_stats": {
    "harmless": 70,
    "malicious": 1,
    "suspicious": 0,
    "undetected": 20,
    "timeout": 0
  },
  "permalink": "https://www.virustotal.com/gui/file/..."
}

`GET /crypto`

`POST /crypto`

⚠️ DEPRECATED — legacy endpoint from v0.0.1, kept for backward compatibility. New integrations should use the dedicated endpoints (/hash, /encrypt, /decrypt).

Perform hashing, encryption, or decryption using the specified algorithm.

Param	Type	Required	Description
`text`	string	✅ Yes	Input plain text (for hashing/encryption) or ciphertext (for decryption).
`algo`	string	✅ Yes	Algorithm to use. Supported: `sha256`, `sha512`, `md5`, `bcrypt`, `argon2`, `blake2b`, `blake2s`, `aes`, `rsa`, `blowfish`, `chacha20`.
`action`	string	❌ No	One of: `hash` (default for hash algos), `encrypt`, `decrypt`. Default: `encrypt`.
`key`	string	⚠️ Depends	Required for encryption/decryption (`aes`, `rsa`, `blowfish`, `chacha20`). Not needed for hash.
`iv`	string	⚠️ Depends	Required (Base64) when decrypting `AES` or `Blowfish`.
`nonce`	string	⚠️ Depends	Required (Base64) when decrypting `ChaCha20`.

Example

POST /crypto
{
  "text": "hello world",
  "algo": "sha256",
  "action": "hash"
}

Response

{
  "algorithm": "sha256",
  "result": "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"
}

🔑 Supported Algorithms

Hashing

sha1 · sha224 · sha256 · sha384 · sha512
sha3-224 · sha3-256 · sha3-384 · sha3-512
md5 · ripemd160
blake2b · blake2s
crc32 · crc32c · adler32
bcrypt · argon2 · scrypt · pbkdf2 (password hashing / KDFs)

Encryption / Decryption

AES-CBC (Base64 ciphertext + IV)
AES-GCM (Base64 ciphertext + Nonce + Tag — authenticated)
ChaCha20 (Base64 ciphertext + Nonce)
Blowfish (CBC mode, Base64 ciphertext + IV)
RSA (PKCS1_OAEP, PEM keys required)

HMAC

sha1 · sha224 · sha256 · sha384 · sha512

JWT

HS256 · HS384 · HS512

Key Generation

RSA key pairs (1024–4096 bit)
AES keys / random bytes / API secrets
Strong passwords · UUID v1/v4

Encoding

Base64 encode/decode · URL encode/decode

🔑 BYOK — Bring Your Own Key

The /external/* endpoints use your API keys, passed in request headers:

Endpoint	Header	Required
`/external/pwned`	`X-Hibp-Api-Key`	✅ Yes
`/external/virustotal`	`X-Virustotal-Api-Key`	✅ Yes

Register free keys at haveibeenpwned.com and virustotal.com — no server-side keys are stored.

⚠️ Error Handling

Examples of possible errors:

Missing Parameters

{
  "error": "Missing required params: text, algo"
}

Unsupported Algorithm

{
  "error": "Unsupported hash algorithm: nope"
}

Decryption Failure

{
  "error": "RSA decryption failed. Ensure a valid PRIVATE key (PEM)."
}

AES-GCM Authentication Failure

{
  "error": "AES-GCM authentication failed: wrong key / tampered data"
}

BYOK Key Missing

{
  "error": "BYOK key missing: provide 'X-Virustotal-Api-Key' header"
}

Upstream Service Failure

{
  "error": "Upstream VirusTotal request failed: ..."
}

🛡️ Security Notes

Always keep keys private & secure.
bcrypt, argon2, scrypt and pbkdf2 are best for password storage.
sha256 and above are preferred for integrity; md5/sha1 are offered for legacy/checksum use only.
Prefer AES-GCM or ChaCha20 over AES-CBC/Blowfish — they are authenticated against tampering.
RSA requires proper PEM-formatted keys.
Passwords sent to /external/pwned never leave in plaintext — only a 5-char SHA-1 prefix is transmitted.
Never log plaintext or keys in production apps.

📝 Changelog

v0.0.2 (Aug 28, 2026)

Split monolithic /crypto into dedicated /hash, /encrypt, /decrypt endpoints
New: /hash/verify, /hmac, /rsa/keys, /keys, /password, /uuid, /encode|decode/base64, /encode|decode/url, /jwt/encode, /jwt/decode
New: BYOK threat lookups /external/pwned (HIBP) and /external/virustotal
New algorithms: SHA-3 family, ripemd160, crc32, crc32c, adler32, scrypt, pbkdf2
New cipher: AES-GCM (authenticated)
/status now returns version, uptime and time
Legacy /crypto remains available but deprecated

v0.0.1 (original)

Single /crypto endpoint: sha256, sha512, md5, bcrypt, argon2, blake2b, blake2s, aes, rsa, blowfish, chacha20

Name		Name	Last commit message	Last commit date
README.md		README.md

Uh oh!

Latest commit

History

Folders and files

Repository files navigation

🔐 Encryption & Hashing Utility API

📅 Version

🌍 Base URL

⚡ Endpoints

GET /status

POST /hash

POST /hash/verify

POST /hmac

POST /encrypt

POST /decrypt

POST /rsa/keys

POST /keys

POST /password

GET /uuid

POST /encode/base64

POST /decode/base64

POST /encode/url

POST /decode/url

POST /jwt/encode

POST /jwt/decode

POST /external/pwned

POST /external/virustotal

GET /crypto

POST /crypto

🔑 Supported Algorithms

Hashing

Encryption / Decryption

HMAC

JWT

Key Generation

Encoding

🔑 BYOK — Bring Your Own Key

⚠️ Error Handling

🛡️ Security Notes

📝 Changelog

About

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

`GET /status`

`POST /hash`

`POST /hash/verify`

`POST /hmac`

`POST /encrypt`

`POST /decrypt`

`POST /rsa/keys`

`POST /keys`

`POST /password`

`GET /uuid`

`POST /encode/base64`

`POST /decode/base64`

`POST /encode/url`

`POST /decode/url`

`POST /jwt/encode`

`POST /jwt/decode`

`POST /external/pwned`

`POST /external/virustotal`

`GET /crypto`

`POST /crypto`