{"uid":"cap_QLyQCSH6VeEHFklSjHUcv","slug":"hash-hmac-api-49347fbc","name":"Hash & HMAC API","description":"Give this API any text or binary data and it returns its fingerprint under whichever hash algorithms you choose - SHA-256, SHA-512, MD5, BLAKE2, CRC32 and more. It also signs data with a secret key (HMAC) and safely verifies whether an incoming signature matches, using a timing-safe comparison. Language models cannot hash: they emit a string of the right length and character set that is simply wrong, so every webhook check built on a guessed hash is silently broken.","url":"https://hash-hmac.underscoredone.com/hash?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"hmac":{"type":"object","description":"Optional. Include this block to sign data or verify a signature. Contains: mode ('sign' or 'verify'), algorithm (md5, sha1, sha256, or sha512), key (your full secret key as a string), and expected_signature (only needed when mode is 'verify')."},"input":{"type":"string","description":"The text or data you want to hash. For binary data, base64-encode it first and set input_encoding to 'base64'."},"algorithms":{"type":"array","description":"Which fingerprint methods to use. Choose any of: md5, sha1, sha224, sha256, sha384, sha512, sha3_256, sha3_512, blake2b, blake2s, crc32, adler32. You may list several at once."},"input_encoding":{"type":"string","description":"How the input is encoded. Use 'utf-8' for normal text (default) or 'base64' for binary data."},"output_encoding":{"type":"string","description":"How to display the resulting fingerprints. Choose 'hex' (default, lowercase letters and numbers), 'base64', or 'base64url' (safe for URLs)."}}},"responseSchema":{"type":"json","example":{"hmac":{"mode":"verify","matches":true,"algorithm":"sha256","computed_signature":"edddd7a6a42a411ab35b993d690cc7bd5d3be3d9262f66fef16ac2be10e0539a"},"digests":{"crc32":"74c679bb","sha256":"aa27c1f5aeb13292cb74153461b1eb3193efe4501c109a99103d304657798cf6","sha512":"f9b133b06a4b7309392429f15108af870c073288f4297b85dba0ebb907f26c71a808abbe1d197f67ad4b7a1ab83507b1ac1774aa0a4295919e7b9697b395be07"},"api_version":"1.0.0","input_bytes":35}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_L3J6RLswIIX1sNMJYsS2P","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Computes cryptographic hashes (SHA-256, SHA-512, MD5, BLAKE2, CRC32, etc.) and signs or timing-safely verifies HMAC signatures for any text or binary input","exampleAgentPrompt":"Can you compute a SHA-256 hash and also an MD5 hash of the text 'Hello, World!' and return the results in hex encoding?","exampleUseCases":null,"resultDescription":"Returns one or more hash digests of the input data in the requested output encoding (hex, base64, or base64url), keyed by algorithm name. When HMAC mode is 'sign', also returns the HMAC signature. When HMAC mode is 'verify', returns a boolean indicating whether the provided expected_signature matches — using a timing-safe comparison to prevent timing attacks.","failureModes":["Unsupported algorithm name provided — API returns error listing valid options","Binary data submitted without base64 encoding and input_encoding set to 'utf-8' — may produce incorrect hash","HMAC verify mode called without expected_signature field — returns validation error","Empty or missing input field — returns bad request error","Invalid base64 encoding in input when input_encoding is 'base64' — returns decoding error","Invalid output_encoding value — returns error listing valid options (hex, base64, base64url)"],"whenToPreferThis":"Use this endpoint whenever you need a cryptographically correct hash or HMAC — language models cannot compute real hash values and will silently produce plausible-looking but wrong results. Prefer this over any LLM-native attempt at hashing, especially for webhook signature verification, cache fingerprinting, idempotency keys, or data integrity checks. It supports a broad range of algorithms (MD5 through BLAKE2 and CRC32) and crucially implements timing-safe HMAC verification to prevent secret-leaking side-channel attacks.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T12:33:54.117Z","isFirstParty":false,"canonicalSlug":"hash-hmac-api-49347fbc"}