Crypto

Hashes, AES and ChaCha20 encryption, bcrypt and Argon2id, HMAC signatures, JWT and UUID — all offline.

Every crypto operation runs on your computer. Passwords, secrets and private keys you type are used for that run only; Quap does not store or send them.

Hash

Turn a value into a fixed-length fingerprint. Use SHA-256 or newer for anything security-related; MD5 and SHA-1 are for checksums and legacy systems.

SHA-256("hello")
→ 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824


Hash	SHA-256	Produce a SHA-256 digest (common secure hash).
Hash	SHA-512	Produce a SHA-512 digest (longer hash).
Hash	MD5	Produce an MD5 digest (fast; not cryptographically strong).
Hash	SHA-1	Produce a SHA-1 digest.
Hash	SHA3-256	Produce a SHA3-256 digest.
Hash	SHA3-512	Produce a SHA3-512 digest.
Hash	BLAKE2b	Produce a BLAKE2b digest.
Hash	BLAKE3	Produce a BLAKE3 digest (fast modern hash).

Encrypt and decrypt

AES-128, AES-256 and ChaCha20 encrypt a value with a password you enter. Decrypt with the same algorithm and password to get the original back. Apply with the Same key scope to encrypt one field in every record — for example every iban — and leave the rest readable.


Encrypt / Decrypt	AES-128	Encrypt with AES-128 (asks for a password).
Encrypt / Decrypt	AES-256	Encrypt with AES-256 (asks for a password).
Encrypt / Decrypt	ChaCha20	Encrypt with ChaCha20 (asks for a password).
Encrypt / Decrypt	AES-128	Decrypt AES-128 ciphertext (asks for a password).
Encrypt / Decrypt	AES-256	Decrypt AES-256 ciphertext (asks for a password).
Encrypt / Decrypt	ChaCha20	Decrypt ChaCha20 ciphertext (asks for a password).

Password hashes

bcrypt and Argon2id produce password hashes for seeding a user table. They are one-way: you cannot get the password back, only verify it.


Password Hash	bcrypt	Hash a password with bcrypt.
Password Hash	Argon2id	Hash a password with Argon2id.

HMAC and JWT

HMAC SHA-256 / SHA-512 signs the selected text with a secret key — the same signature a webhook sender computes. Paste the payload, select it, run HMAC and compare the output with the signature header.


Sign / Verify	SHA-256	Create an HMAC-SHA256 signature (asks for a secret).
Sign / Verify	SHA-512	Create an HMAC-SHA512 signature (asks for a secret).
Sign / Verify	Encode HS256	Build an HS256 JWT from a JSON payload.
Sign / Verify	Encode RS256	Build an RS256 JWT from a JSON payload (RSA key).
Sign / Verify	Encode ES256	Build an ES256 JWT from a JSON payload (EC key).
Sign / Verify	Decode	Split a JWT into header/payload without verifying.
Sign / Verify	Verify HS256	Verify an HS256 JWT signature.
Sign / Verify	Verify RS256	Verify an RS256 JWT signature.
Sign / Verify	Verify ES256	Verify an ES256 JWT signature.

UUID

v4 gives a random UUID; v7 gives a time-ordered one that sorts by creation time (good for database keys). With nothing selected the UUID is inserted at the cursor; with values selected each one is replaced — use Same key to give every record a new id.


UUID	v4	Generate a random UUID v4 (inserts at caret if no selection).
UUID	v7	Generate a time-ordered UUID v7 (inserts at caret if no selection).