Data protection · REST API

Cryptography API: hashing, encryption and decryption

Generate cryptographic hashes, encrypt data with authenticated AES-GCM and decrypt encrypted payloads using three REST endpoints.

Free tier available. All endpoints require a JWT Bearer Token.

Hash generation Encryption Decryption

Key features

Cryptographic hashing

MD5, SHA-1, SHA-256, SHA-384 and SHA-512 with HEX or BASE64 output.

Authenticated AES-GCM

AES-128-GCM, AES-192-GCM and AES-256-GCM with authentication tag verification.

Flexible key management

Use a password-derived key (PASSWORD) or a Base64-encoded raw AES key (KEY).

Generate a cryptographic hash

Hash input data with the selected algorithm and choose HEX or BASE64 output encoding.

Endpoint

POST /api/v1/data-protection/hash

Request: application/json · Response: application/json

Example SHA-256 request

Request

{
  "data": "Hello World",
  "algorithm": "SHA-256",
  "encoding": "HEX"
}

Illustrative response structure

{
  "algorithm": "SHA-256",
  "encoding": "HEX",
  "hash": "a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e"
}

MD5 and SHA-1 are available for compatibility, but should not be used for new security-sensitive integrations. Hashing is one-way; it is not encryption.

Hash endpoint in Swagger

Encrypt data using AES-GCM

Choose AES-128-GCM, AES-192-GCM or AES-256-GCM. PASSWORD derives the key using PBKDF2-HMAC-SHA256; KEY accepts a Base64-encoded AES key. The API generates a fresh IV and, for PASSWORD mode, a salt.

Endpoint

POST /api/v1/data-protection/crypt

Request: application/json · Response: application/json

Example PASSWORD-mode request

Request

{
  "data": "Hello World",
  "algorithm": "AES-256-GCM",
  "mode": "PASSWORD",
  "password": "ReplaceWithAStrongSecret",
  "encoding": "UTF-8"
}

Response fields (generated values vary)

{
  "version": 1,
  "algorithm": "AES-256-GCM",
  "mode": "PASSWORD",
  "ciphertext": "<generated Base64 ciphertext and tag>",
  "salt": "<generated Base64 salt>",
  "iv": "<generated Base64 IV>",
  "kdf": {
    "algorithm": "PBKDF2WithHmacSHA256",
    "iterations": 600000
  },
  "encoding": "UTF-8"
}

Preserve the returned ciphertext, IV, salt, KDF metadata, algorithm, mode, version and encoding for decryption. The password and raw key are not returned.

Encryption endpoint in Swagger

Decrypt an AES-GCM payload

Provide the original encryption metadata and the same password or key. If AAD was used during encryption, provide the identical AAD value.

Endpoint

POST /api/v1/data-protection/decrypt

Request: application/json · Response: application/json

PASSWORD-mode request structure (replace placeholders with actual /crypt response values)

Request

{
  "version": 1,
  "algorithm": "AES-256-GCM",
  "mode": "PASSWORD",
  "ciphertext": "<ciphertext from /crypt>",
  "salt": "<salt from /crypt>",
  "iv": "<iv from /crypt>",
  "kdf": {
    "algorithm": "PBKDF2WithHmacSHA256",
    "iterations": 600000
  },
  "password": "ReplaceWithAStrongSecret",
  "encoding": "UTF-8"
}

Successful response structure

{
  "version": 1,
  "algorithm": "AES-256-GCM",
  "mode": "PASSWORD",
  "data": "Hello World",
  "encoding": "UTF-8"
}

AES-GCM verifies the authentication tag. An incorrect password, key, IV, ciphertext or AAD causes authentication to fail.

Decryption endpoint in Swagger

Supported options

Encryption and hashing options
Field Supported values or behavior
hash.algorithm MD5, SHA-1, SHA-256, SHA-384, SHA-512
hash.encoding HEX (default), BASE64
crypt.algorithm AES-GCM with 128-, 192- or 256-bit keys.
mode PASSWORD: PBKDF2-HMAC-SHA256; KEY: Base64-encoded AES key.
encoding UTF-8 text or Base64-encoded binary input.
aad Optional Additional Authenticated Data; must match during decryption.

Use cases

  • Generate hashes for text or data integrity workflows.
  • Encrypt confidential application data before storage or transmission.
  • Decrypt AES-GCM payloads with authenticated integrity checks.

Security considerations

Protect plaintext, passwords and encryption keys. Never reuse an IV with the same AES key. General-purpose hashes are not suitable for storing passwords; use the dedicated Password Hashing API.

Explore more DevHub APIs

Password hashing API API catalog Rate limits SDKs
loader