Hashing blocks#

The Hashing category turns a piece of text into a fixed-length fingerprint. Every block here takes a string on Input and emits the digest as a lowercase hex string on Output. The one exception is CRC32, which emits uppercase hex. If the input is empty, you get an empty string back.

SHA-1, SHA-256 and SHA-512 run natively, so they stay fast on large inputs. MD5, SHA-224, SHA-384, SHA-3 and RIPEMD160 use a slower fallback path, which you may notice on a large amount of data.

The dedicated blocks (MD5, SHA1, SHA256 and SHA512) take no arguments. Prefer one of them over the generic Hashing block when the algorithm is fixed, because the canvas then documents itself. You see the algorithm on the canvas and do not need to open the block.

Hashing#

One block that computes any of the supported algorithms, picked from a dropdown. Reach for it when you might want to switch algorithm partway through an investigation without rewiring the flow.

• Algorithm - the digest to compute. Options: MD5, SHA1, SHA224, SHA256, SHA384, SHA512, SHA3, RIPEMD160 (default SHA256).

MD5#

Computes an MD5 digest. Useful for matching against older indicator lists, which still often record MD5.

SHA1#

Computes a SHA-1 digest.

SHA256#

Computes a SHA-256 digest. This is the most common choice for fingerprinting indicators, so start here unless you have a reason not to.

SHA512#

Computes a SHA-512 digest.

CRC32#

Computes a CRC32 checksum and emits it as uppercase hex. CRC32 is a non-cryptographic checksum. It is fine for comparing two copies of the same data for integrity, but not for anything security-sensitive.

HMAC#

Produces a keyed digest over the input. Two parties that hold the same key can check that nobody changed the message in transit.

• Key - the shared secret, as text. Default empty.
• Algorithm - the digest used underneath. Options: MD5, SHA1, SHA256, SHA512, RIPEMD160 (default SHA256).