# Crypto

Hash, sign with HMAC, encode, and make random values.

## Do things in Crypto

Add a **Crypto** step and choose an **Operation**. Choose the row to see the fields of each.

- [Compute](https://docs.gorunner.io/apps/crypto#fields-f-compute): MD5 · SHA-1 · SHA-256 · SHA-384 · SHA-512 · SHA3-256 · SHA3-384 · SHA3-512 · HMAC-SHA1 · HMAC-SHA256 · HMAC-SHA512 · Base64 Encode · Base64 Decode · Hex Encode · Hex Decode · Generate UUID · Generate Random · RSA Sign · RSA Verify

Later steps read a step’s output by its name: see [Use data from earlier steps](https://docs.gorunner.io/build/use-data-from-earlier-steps).

**What changed in version 2?**

New steps use version 2.0.0. A step made before keeps 1.0.0 and works as it always has. The step’s panel shows its version at the top right. On an older step it reads **v1.0.0 · 2.0.0 available**: press it to choose the version.

In 2.0.0: To make a UUID, choose the operation **Generate UUID**. In version 1.0.0, **Generate Random** also offered UUID as a **Format**. Everything else is the same.

Not in your list? See [When an app isn’t here](https://docs.gorunner.io/apps/when-an-app-isnt-here#q-not-in-list).

## For developers

In the API, which calls apps pieces, Crypto is `pieceId: "crypto"` with `actionId: "compute"`, set by `operation`. [Get an app](https://docs.gorunner.io/api/apps/get-app) returns every field.

It computes from its inputs only (`pure`). See [How versions and side effects work](https://docs.gorunner.io/apps#q-versions).

### Crypto › Compute

Hash, HMAC, encode/decode, generate UUID, or random bytes.

### MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-384 and SHA3-512

- **Text · Required**: The text to process, for example a password, message, or token to scramble, encode, or sign.
- **Output Encoding · Optional**: How to display the result text: Hexadecimal (0-9, a-f) or Base64 (a shorter mix of letters and digits). Options: Hexadecimal, Base64. Default: Hexadecimal.

### HMAC-SHA1, HMAC-SHA256 and HMAC-SHA512

- **Text · Required**: The text to process, for example a password, message, or token to scramble, encode, or sign.
- **Secret Key · Required**: The shared password used to sign the text so others can confirm it was not tampered with.
- **Secret Encoding · Optional**: How to read the Secret Key before signing. UTF-8 (the default) uses the text exactly as written: right for a password you chose and for most webhook secrets, including GitHub and Stripe (use Stripe's whsec_… value whole, prefix included). Pick Hex or Base64 only when the provider says the secret is an encoding of the key bytes: for Svix or Clerk, paste the part after whsec_ and pick Base64. Options: UTF-8 (plain text, default), Hexadecimal, Base64. Default: UTF-8 (plain text, default).
- **Output Encoding · Optional**: How to display the result text: Hexadecimal (0-9, a-f) or Base64 (a shorter mix of letters and digits). Options: Hexadecimal, Base64. Default: Hexadecimal.

### Base64 Encode, Base64 Decode, Hex Encode and Hex Decode

- **Text · Required**: The text to process, for example a password, message, or token to scramble, encode, or sign.

### Generate UUID

Nothing to fill in.

### Generate Random

- **Format · Optional**: What style of random value to create: Hex or Base64 text. For a unique ID, use Operation › Generate UUID. Options: Hex, Base64. Default: Hex.
- **Byte Length · Optional**: How long the random value should be; bigger means harder to guess (such as 32). Default: 32.

### RSA Sign

- **Text · Required**: The text to process, for example a password, message, or token to scramble, encode, or sign.
- **Hash Algorithm · Optional**: The strength setting used when signing or checking; use the same one on both sides (SHA-256 is fine). Options: SHA-256, SHA-384, SHA-512. Default: SHA-256.
- **Private Key (PEM) · Required**: RSA private key in PEM format (PKCS#1 or PKCS#8).
- **Signature Encoding · Optional**: The text format of the signature. When verifying, match the format it was created in (often Base64). Options: Base64, Hexadecimal. Default: Base64.

### RSA Verify

- **Text · Required**: The text to process, for example a password, message, or token to scramble, encode, or sign.
- **Hash Algorithm · Optional**: The strength setting used when signing or checking; use the same one on both sides (SHA-256 is fine). Options: SHA-256, SHA-384, SHA-512. Default: SHA-256.
- **Public Key (PEM) · Required**: RSA public key in PEM format (PKIX/SPKI or PKCS#1).
- **Signature · Required**: The signature to verify (in the selected encoding).
- **Signature Encoding · Optional**: The text format of the signature. When verifying, match the format it was created in (often Base64). Options: Base64, Hexadecimal. Default: Base64.

Source: https://docs.gorunner.io/apps/crypto