HPKP / SPKI Pinning Hash Generator
Hashes the supplied Base64-decoded bytes with SHA-256 and formats a pin. The tool does not verify that those bytes are a valid SPKI public key; HPKP is obsolete.
About this hpkp / spki pinning hash generator
Hashes the supplied Base64-decoded bytes with SHA-256 and formats a pin. The tool does not verify that those bytes are a valid SPKI public key; HPKP is obsolete Runs entirely in-memory using Web Crypto primitives to keep sensitive tokens, certificates, and cryptographic keys secure from third-party interception.
Encoding & cryptographic principles
Parses, inspects, and validates public key infrastructure certificates and requests conforming to RFC 5280 (X.509 v3 Certificates), RFC 2986 (PKCS#10 Certificate Signing Requests - CSR), and RFC 7468 (PEM Encapsulation). Deconstructs ASN.1 DER binary byte streams to extract Subject, Issuer, Validity Period (NotBefore / NotAfter), Public Key Algorithm (RSA, ECDSA, Ed25519), Key Usage, Extended Key Usage, and Subject Alternative Names (SANs). Calculates SHA-256 certificate fingerprints and validates public key matching.
Worked verification example
Scenario: Calculate a pin over explicitly supplied base64 bytes and retain the SPKI limitation.
Sample input:
Processing: Base64-decodes the supplied bytes and applies SHA-256 without validating an SPKI container.
Illustrative output:
Security parameters & input constraints
The page hashes the supplied bytes without parsing or verifying an SPKI public key. A PEM wrapper alone does not prove SPKI structure or certificate ownership. HPKP is obsolete in modern browsers; the generated header is historical reference text, not a recommended deployment configuration.
Cryptographic digests, encoded strings, and signatures generated by HPKP / SPKI Pinning Hash Generator should be verified against target authentication systems before production use.
Client-side Web Crypto boundary
Key derivation, hashing, and encoding in HPKP / SPKI Pinning Hash Generator execute in local memory using Web Crypto APIs without remote socket transmission.
Cryptographic specifications & RFC standards
Technical specifications and cryptographic RFC standards governing algorithms and key representations:
HPKP / SPKI Pinning Hash Generator verification · Audit standards
How to use it
- Paste Base64 bytes or a PEM public-key block.
- Strip PEM wrappers and whitespace, Base64-decode the supplied bytes, then hash them with SHA-256.
- Display the Base64 digest, pin-sha256 header text, PEM-detection flag and warning as JSON.
Frequently asked questions
What bytes does HPKP Pin Generator hash?+
It removes PEM public-key headers, whitespace, and then base64-decodes the remaining text. SHA-256 is calculated over exactly those supplied bytes.
What does the result include?+
The JSON returns algorithm SHA-256, a base64 pin, a pin-sha256 header value, whether PEM markers were supplied, and an explicit HPKP-obsolescence warning.
What example can I run locally?+
Base64 input AQID produced pin A5BYxvLAy0ksUzsKTRTvd8wPeKvMztUofYShogEc+4E= and the matching pin-sha256 header.
Does this validate an SPKI structure or current TLS policy?+
No. It hashes the caller-provided bytes without validating that they encode SPKI. The result also warns that HPKP is obsolete.