HPKP / SPKI Pinning Hash Generator
HPKP / SPKI Pinning Hash Generator: Computes SHA-256 digest across the SubjectPublicKeyInfo DER byte sequence and Base64 encodes.
About this hpkp / spki pinning hash generator
HPKP / SPKI Pinning Hash Generator — browser-based utility.
How this tool works
Implements client-side HPKP / SPKI Pinning Hash Generator operations. Computes SHA-256 digest across the SubjectPublicKeyInfo DER byte sequence and Base64 encodes specifically designed for a web administrator generates a public key pin hash (spki pin) for certificate pinning.
- PEM Armor Stripping & DER Decoding: Strips '-----BEGIN CERTIFICATE-----' headers and decodes Base64 to raw ASN.1 DER binary bytes.
- ASN.1 Structure Traversal: Parses the TBSCertificate sequence, extracting serial numbers, signature algorithms, and X.500 distinguished names.
- Extension Extraction: Decodes X.509v3 extensions, extracting SAN DNS names, basic constraints (CA flag), and key usage flags.
- Diagnostic Reporting: Computes SHA-256 fingerprint, checks expiration status against the current date, and warns if certificates are expired or self-signed.
Worked example
Scenario: Calculate a pin over explicitly supplied base64 bytes and retain the SPKI limitation.
Sample input:
Processing: Base64-decodes the supplied bytes and applies SHA-256 without validating an SPKI container.
Illustrative output:
Limits and verification
Rejects corrupted PEM files with invalid Base64 characters or missing encapsulation boundaries. Warns users when inspecting self-signed root certificates or certificates with weak 1024-bit RSA keys.
Examples demonstrate an expected workflow; they do not prove every input or every branch of an external specification. Check important results with an independent source before using them for money, security, compliance, safety, or irreversible file changes.
Browser processing boundary
Tool input is processed by code running in the browser and is not intentionally sent to a CZOA processing API. The page can still request ordinary site assets, analytics, or advertising when those services are enabled. Browser extensions and managed-device software remain outside this tool's control.
Relevant references
These references govern or help explain the format, protocol, or calculation used here. Listing a reference does not claim certification or complete implementation of every optional feature.
Content owner: CZOA Tools · Last reviewed: 2026-09-15 · Review methodology
How to use it
- Enter, paste, or select your input data into the HPKP / SPKI Pinning Hash Generator workspace controls.
- Review available parameter fields, units, formats, or options configured for your task.
- Click the action button or observe immediate live calculations rendered in your browser runtime.
- Inspect the resulting output and any diagnostic messages, then copy or download the result if needed.
Frequently asked questions
What bytes does HPKP Pin Generator hash?+
It removes PEM public-key headers, whitespace, and then base64-decodes the remaining text. SHA-256 is calculated over exactly those supplied bytes.
What does the result include?+
The JSON returns algorithm SHA-256, a base64 pin, a pin-sha256 header value, whether PEM markers were supplied, and an explicit HPKP-obsolescence warning.
What did the browser fixture verify?+
Base64 input AQID produced pin A5BYxvLAy0ksUzsKTRTvd8wPeKvMztUofYShogEc+4E= and the matching pin-sha256 header.
Does this validate an SPKI structure or current TLS policy?+
No. It hashes the caller-provided bytes without validating that they encode SPKI. The result also warns that HPKP is obsolete.