Encryption & Hashing Utility API

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

GET /status

Health check. Returns API name, version, uptime and current UTC time.

Example

GET /status

Response

{
  "ok": true,
  "name": "Encryption & Hashing Utility API",
  "version": "v0.0.2",
  "uptime_seconds": 1234.5,
  "time": "2026-08-28T09:00:00Z"
}

Source contract imported from encryption & hashing utility API/app.py. Handler: status. Reference: RAPID_README.md.

Snapshot from docs/ENDPOINTS.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

GET /meta

Machine-readable metadata: version + every available endpoint.

curl http://127.0.0.1:5000/meta

Source contract imported from encryption & hashing utility API/app.py. Handler: meta. Reference: docs/ENDPOINTS.md.

Snapshot from docs/ENDPOINTS.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /hash

Hash arbitrary text.

Body:

Supported algorithms:

Example — SHA-256:

curl -X POST http://127.0.0.1:5000/hash \
  -H "Content-Type: application/json" \
  -d '{"text": "hello world", "algo": "sha256"}'

{ "algorithm": "sha256", "result": "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9" }

Example — bcrypt (cost 10):

{ "algorithm": "bcrypt", "result": "$2b$10$9ZxNYjy2SrLMfglfN173EuCFYXPSPBDwslwyNdwybIybzogHn8te." }

Example — scrypt (returns salt too, for later reproduction):

{
  "algorithm": "scrypt",
  "result": "3f24780d883ad2c937ba530553fa97a5bedfb05e3baf108aa7e0a6308386ef09b...",
  "salt": "t92n4puQNcbvlBPysv92yg==",
  "params": { "n": 16384, "r": 8, "p": 1 }
}

Note: md5 and sha1 are cryptographically broken — use SHA-256+ for security

purposes; they are offered for compatibility and checksum workloads.

Source contract imported from encryption & hashing utility API/app.py. Handler: hash_endpoint. Reference: docs/ENDPOINTS.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /hash/verify

Verify a bcrypt or argon2 hash against a plaintext password. Ideal for login flows.

Example

POST /hash/verify
{
  "text": "mypassword",
  "algo": "argon2",
  "hash": "$argon2id$v=19$m=65536,t=3,p=4$..."
}

Response

{
  "algorithm": "argon2",
  "verified": true
}

Source contract imported from encryption & hashing utility API/app.py. Handler: hash_verify. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /hmac

Sign a message with an HMAC key (SHA-1/224/256/384/512). Use for API request signing, webhook validation and message integrity.

Example

POST /hmac
{
  "text": "message",
  "key": "secret",
  "algo": "sha256"
}

Response

{
  "algorithm": "sha256",
  "result": "8b5f48702995c1598c573db1e21866a9b825d4a794d169d7060a03605796360b"
}

Source contract imported from encryption & hashing utility API/app.py. Handler: hmac_endpoint. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /encrypt

Encrypt text with 5 ciphers: AES-CBC, AES-GCM (authenticated), ChaCha20, Blowfish and RSA-OAEP. Returns base64 ciphertext plus the iv / nonce / tag needed for decryption.

Example — AES-GCM (recommended, authenticated)

POST /encrypt
{
  "text": "secret data",
  "algo": "aes-gcm",
  "key": "mysecretkey123"
}

Response

{
  "algorithm": "AES-GCM",
  "result": {
    "ciphertext": "dQmpD2zuCEA=",
    "nonce": "YIpfsm2fZMzSH2fi3gH9ew==",
    "tag": "id6eLlLQpC/jc+0zdemNew==",
    "mode": "GCM"
  }
}

Example — AES-CBC

POST /encrypt
{
  "text": "secret data",
  "algo": "aes-cbc",
  "key": "mysecretkey123"
}

Response

{
  "algorithm": "AES-CBC",
  "result": {
    "ciphertext": "4tD5a8l1oG+Q6...",
    "iv": "jhs78J9n0sdh==",
    "mode": "CBC"
  }
}

Example — RSA

POST /encrypt
{
  "text": "hidden message",
  "algo": "rsa",
  "key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkq...\n-----END PUBLIC KEY-----"
}

Response

{
  "algorithm": "RSA",
  "result": {
    "ciphertext": "Lk23a9hdJd+Skj2..."
  }
}

Source contract imported from encryption & hashing utility API/app.py. Handler: encrypt. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /decrypt

Decrypt ciphertext produced by /encrypt (AES-CBC, AES-GCM, ChaCha20, Blowfish, RSA). AES-GCM verifies authenticity and rejects tampered data.

Example

POST /decrypt
{
  "algo": "aes-gcm",
  "key": "mysecretkey123",
  "ciphertext": "dQmpD2zuCEA=",
  "nonce": "YIpfsm2fZMzSH2fi3gH9ew==",
  "tag": "id6eLlLQpC/jc+0zdemNew=="
}

Response

{
  "algorithm": "AES-GCM",
  "result": "secret data"
}

Source contract imported from encryption & hashing utility API/app.py. Handler: decrypt. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /rsa/keys

Generate a fresh RSA key pair (1024–4096 bit) as PEM. Returns both private and public keys.

Example

POST /rsa/keys
{
  "bits": 2048
}

Response

{
  "algorithm": "RSA",
  "bits": 2048,
  "private_key": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----",
  "public_key": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----"
}

Source contract imported from encryption & hashing utility API/app.py. Handler: rsa_keys. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /rsa/keys

Generate a fresh RSA key pair (1024–4096 bit) as PEM. Returns both private and public keys.

Example

POST /rsa/keys
{
  "bits": 2048
}

Response

{
  "algorithm": "RSA",
  "bits": 2048,
  "private_key": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----",
  "public_key": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----"
}

Source contract imported from encryption & hashing utility API/app.py. Handler: generate_keys. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /password

Generate a cryptographically strong random password, guaranteed to contain lowercase, uppercase and digits (plus symbols if enabled).

Example

POST /password
{
  "length": 16,
  "symbols": true
}

Response

{
  "length": 16,
  "result": "6?9t_Qa;Y?1kry,[",
  "symbols": true
}

Source contract imported from encryption & hashing utility API/app.py. Handler: password. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

GET /uuid

Generate a UUID v4 (random) or v1 (time-based).

Example

GET /uuid?version=4

Response

{
  "version": "4",
  "result": "2ae5a0c1-0315-49a9-92cd-fdece27f048b"
}

Source contract imported from encryption & hashing utility API/app.py. Handler: uuid_endpoint. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /encode/base64

Encode any text to base64.

Example

POST /encode/base64
{
  "text": "hello world"
}

Response

{
  "encoding": "base64",
  "result": "aGVsbG8gd29ybGQ="
}

Source contract imported from encryption & hashing utility API/app.py. Handler: encode_base64. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /decode/base64

Decode a base64 string back to text.

Example

POST /decode/base64
{
  "text": "aGVsbG8gd29ybGQ="
}

Response

{
  "encoding": "base64",
  "result": "hello world"
}

Source contract imported from encryption & hashing utility API/app.py. Handler: decode_base64. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /encode/url

Percent-encode a string for safe use in URLs and query strings.

Example

POST /encode/url
{
  "text": "a b&c=d"
}

Response

{
  "encoding": "url",
  "result": "a%20b%26c%3Dd"
}

Source contract imported from encryption & hashing utility API/app.py. Handler: encode_url. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /decode/url

Decode a percent-encoded string back to readable text.

Example

POST /decode/url
{
  "text": "a%20b%26c%3Dd"
}

Response

{
  "encoding": "url",
  "result": "a b&c=d"
}

Source contract imported from encryption & hashing utility API/app.py. Handler: decode_url. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /jwt/encode

Create a signed JWT (HS256/HS384/HS512) from any JSON payload — for auth tokens, session tokens and API keys.

Example

POST /jwt/encode
{
  "payload": {
    "user": "dakid",
    "role": "admin"
  },
  "secret": "s3cret",
  "algo": "HS256"
}

Response

{
  "algorithm": "HS256",
  "result": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZGFraWQiLCJyb2xlIjoiYWRtaW4ifQ.Mc0J6lOOZEfuvlfwVQjoHt60cCc3uFKKJpXn0N_r5J8"
}

Source contract imported from encryption & hashing utility API/app.py. Handler: jwt_encode. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /jwt/decode

Verify a JWT signature and decode its payload. Returns an error for wrong secrets, expired or tampered tokens.

Example

POST /jwt/decode
{
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "secret": "s3cret"
}

Response

{
  "payload": {
    "user": "dakid",
    "role": "admin"
  }
}

Source contract imported from encryption & hashing utility API/app.py. Handler: jwt_decode. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /external/pwned

Check if a password has appeared in known data breaches via Have I Been Pwned. Uses k-anonymity — only the first 5 characters of the SHA-1 hash leave your device; the password itself is never transmitted. BYOK: supply your own X-Hibp-Api-Key header (optional — works keyless).

Example

POST /external/pwned
{
  "password": "password123"
}

Response

{
  "service": "Have I Been Pwned",
  "sha1_prefix": "CBFDA",
  "breached": true,
  "occurrences": 2266543,
  "key_used": false,
  "message": "Password appears 2266543 time(s) in known breaches."
}

Source contract imported from encryption & hashing utility API/app.py. Handler: pwned. Reference: RAPID_README.md.

Snapshot from RAPID_README.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /external/virustotal

Look up the malware reputation of a file hash (MD5/SHA1/SHA256) in VirusTotal's database. Returns detection stats and a permalink. BYOK: requires your own X-Virustotal-Api-Key header.

Example

POST /external/virustotal
{
  "resource": "d41d8cd98f00b204e9800998ecf8427e"
}

Response

{
  "service": "VirusTotal",
  "found": true,
  "sha256": "...",
  "md5": "...",
  "sha1": "...",
  "reputation": 0,
  "meaningful_name": "file.exe",
  "last_analysis_stats": {
    "harmless": 70,
    "malicious": 1,
    "suspicious": 0,
    "undetected": 20,
    "timeout": 0
  },
  "permalink": "https://www.virustotal.com/gui/file/..."
}

Source contract imported from encryption & hashing utility API/app.py. Handler: virustotal. Reference: RAPID_README.md.