---
title: Crypto
description: Hash, HMAC and generate random values with WebCrypto
---

Hash or sign text, or generate random values and UUIDs, right in the browser.

Optional: pick a saved connection in the **HMAC Key** field when the service needs one.

## What it does

Crypto runs once per incoming item and puts its result in **Put Result In Field** (`result` by default). It has four operations:

* **Hash** turns text into a fingerprint with SHA-1, SHA-256, SHA-512 or MD5. The same text always gives the same hash.
* **HMAC** signs text with a secret key taken from a saved credential, using SHA-1, SHA-256 or SHA-512.
* **Random bytes** generates random bytes, 32 by default and at most 1024.
* **UUID v4** generates a random unique id such as `3f2b8c1e-…`.

Hashes, signatures and random bytes come out as lowercase hex or base64 text, depending on **Encoding**.

## When to use it

* Fingerprint scraped content so you can tell later whether it changed.
* Sign a payload with HMAC before you send it to an API or webhook that checks signatures.
* Create an idempotency key or a random id for each outgoing item.
* Use MD5 only when another system expects an MD5 checksum. It is not safe for security purposes.

## Inputs and settings

* For Hash and HMAC, the node reads the text from **Text** first, for example `{{ $input.body }}`. If **Text** is empty, it reads the field named in **Source Field** (dots work for nested fields).
* **Byte Length** only matters for *Random bytes*. Values above 1024 are reduced to 1024.

## Outputs

Each item comes out with the result as text in **Put Result In Field**, next to its original fields. Turn off **Include Input Fields** to output only the result. Use it downstream with `{{ $input.result }}`.

## Dependencies and credentials

* **HMAC Key** (connection): optional. See [Create a connection](/app/connections/).

Only *HMAC* needs a credential. Save the shared secret as a token credential (API Token / Bearer) and pick it in **HMAC Key**; see [Create a credential](/app/connections/create/). The secret stays in your credential store, so it is not included when you export or share the workflow.

## Example workflow

1. [Edit Fields](/nodes/builtin/datatransformation/editfields/) builds the payload text in a field named `body`.
2. Crypto with **Operation** *HMAC*, **Algorithm** *SHA-256*, **HMAC Key** set to your saved secret, **Text** `{{ $input.body }}` and **Encoding** *Hex*.
3. [Http Request](/nodes/builtin/core/http-request/) sends `body` and adds a signature header with the value `{{ $input.result }}`.

## Common issues

* **"HMAC requires a credential holding the secret key. Select one in the HMAC Key field."** Pick or create a credential in **HMAC Key**.
* **"MD5 is not a valid HMAC algorithm. Choose SHA-1, SHA-256, or SHA-512."** MD5 works for *Hash* only. Change **Algorithm**.
* **"No text to hash. Fill in the Text field, or name the field holding it."** Both **Text** and **Source Field** are empty.
* **"Field "…" does not exist on the incoming item."** The name in **Source Field** is wrong or the field is empty. Check its spelling against the previous node's output.
* **The signature does not match what the other service expects.** Check that both sides use the same algorithm and encoding (hex vs base64), and that you sign exactly the same text, including spaces and line breaks.

## Related nodes

* [Edit Fields](/nodes/builtin/datatransformation/editfields/): prepare the text before hashing it.
* [Remove Duplicates](/nodes/builtin/datatransformation/removeduplicates/): drop items you have already seen.
* [Code](/nodes/builtin/core/code/): for cryptography this node does not cover.