Get Started

Hash and Encrypt

Hash, encrypt, and encode data directly in your HubSpot workflows for security, privacy, and data integrity.

On this page

Overview

The Hash and Encrypt action provides cryptographic operations within your HubSpot workflows. Use it to hash data for anonymization, encrypt sensitive information, sign API requests with HMAC, or encode/decode data in Base64 format.

All cryptographic operations use industry-standard algorithms implemented via Node.js built-in crypto module. No data leaves AuPerate servers during hashing or encryption -- everything is processed in memory.

Use Cases

  • Anonymize PII

    Hash email addresses with SHA-256 before sending to analytics or advertising platforms. The hash is irreversible, protecting user privacy.

  • Generate tokens

    Create unique identifiers or verification tokens by hashing a combination of properties and timestamps.

  • Secure API signing

    Use HMAC-SHA256 to sign webhook payloads or API requests that require signature verification.

  • Data integrity checks

    Hash data before and after transfer to verify nothing was modified in transit.

  • Encrypt sensitive data

    Use AES-256 to encrypt sensitive property values before sending them to external systems.

Setup

1

Add the action to your workflow

Search for "AuPerate: Hash and Encrypt" in the HubSpot workflow editor.

2

Select the algorithm

Choose the hashing or encryption algorithm from the dropdown: MD5, SHA-1, SHA-256, SHA-512, HMAC-SHA256, AES-256 Encrypt, AES-256 Decrypt, Base64 Encode, or Base64 Decode.

3

Map the input value

Map a HubSpot property to the input field. For HMAC and AES algorithms, also provide the secret key.

Algorithms

MD5Not cryptographically secure

128-bit hash function. Fast but vulnerable to collision attacks. Use only for checksums, cache keys, or non-security-critical identifiers. Do not use for passwords or security-sensitive data.

Input:  "john@example.com"
Output: "d4c74594d841139328695756648b6bd6"
SHA-1Legacy -- use SHA-256 instead

160-bit hash. Deprecated for security use. Only use when a third-party system specifically requires SHA-1. For new implementations, always use SHA-256.

Input:  "john@example.com"
Output: "e8e3e0d6e2ebc946c6e2f2e7e3e7b9a8f1c2d3e4"
SHA-256Recommended

256-bit hash from the SHA-2 family. Recommended for most hashing needs: email anonymization, data integrity, identifier generation. Secure, widely supported, and industry standard.

Input:  "john@example.com"
Output: "a8b14f04b2402d2f5d6af...ef6c1ea34f1b2c3d4e5f6"
SHA-512

512-bit hash for maximum security. Produces a longer hash output. Use when the highest level of hash security is required or when a system specifically requires SHA-512.

HMAC-SHA256Requires secret key

Keyed-hash message authentication code. Combines a secret key with the data to produce a signature that can be verified by the recipient. Commonly used for webhook signature verification and API request signing.

Input:      "payload data to sign"
Secret Key: "your-32-byte-hex-secret-key-here"
Output:     "a1b2c3d4e5f6...signature-hash"
AES-256 EncryptRequires secret key

Symmetric encryption using AES-256 algorithm. Encrypts plaintext into ciphertext that can be decrypted with the same key. Use for reversible encryption of sensitive data before sending to external systems.

Input:      "sensitive-data-here"
Secret Key: "your-32-byte-hex-secret-key"
Output:     "iv:encrypted-ciphertext-in-hex"
AES-256 DecryptRequires secret key

Decrypts data that was encrypted with AES-256 Encrypt using the same secret key. The input must be in the format iv:ciphertext as produced by AES-256 Encrypt.

Base64 Encode

Encodes data to Base64 format. Commonly used for API authentication (Basic auth), embedding binary data in JSON, or preparing data for systems that only accept ASCII.

Input:  "user:password123"
Output: "dXNlcjpwYXNzd29yZDEyMw=="
Base64 Decode

Decodes Base64 encoded data back to its original form. Use when receiving Base64 encoded data from external systems.

Input:  "dXNlcjpwYXNzd29yZDEyMw=="
Output: "user:password123"

Configuration

Input Value Required

The HubSpot property value to hash, encrypt, or encode. Map a property from the enrolled record (e.g., email, phone, hs_object_id).

Algorithm Required

Select the algorithm from the dropdown. The available options are: MD5, SHA-1, SHA-256, SHA-512, HMAC-SHA256, AES-256 Encrypt, AES-256 Decrypt, Base64 Encode, Base64 Decode.

Secret Key Required for HMAC and AES

A 32-byte hexadecimal key used for HMAC-SHA256 and AES-256 operations. This key must be stored as an AuPerate Secret for security.

Never hard-code secret keys in your workflow configuration. Always reference an AuPerate Secret. The key must be exactly 64 hex characters (32 bytes). Generate one with:openssl rand -hex 32

Examples

1Hash an email for anonymous tracking

Hash a contact's email with SHA-256 to create an anonymous identifier for advertising platforms like Google Ads or Facebook Custom Audiences.

Algorithm: SHA-256
Input: email = john@example.com
Result
a8b14f04b2402d2f5d6af15e3421a7ef6c1ea34f1b2c3d4e5f6a7b8c9d0e1f2a
Tip: Lowercase the email before hashing for consistent results across platforms. Use a Format Data action with the lowercase operation before the Hash action.

2HMAC signature for webhook verification

Create an HMAC-SHA256 signature to include in webhook requests so the receiving server can verify the payload is authentic.

Algorithm: HMAC-SHA256
Input: {"event":"deal_closed","deal_id":"12345"}
Secret Key: AuPerate Secret: WEBHOOK_SIGNING_KEY

Pass the resulting signature as a header (e.g., X-Signature) in a subsequent Send Webhook action. The receiver verifies by computing the same HMAC with the shared secret.

3Encrypt sensitive data before sending externally

Encrypt a phone number with AES-256 before sending it to an external system via webhook.

Algorithm: AES-256 Encrypt
Input: phone = +1-555-0123
Secret Key: AuPerate Secret: ENCRYPTION_KEY
Result
a1b2c3d4e5f6a7b8:9f8e7d6c5b4a3928170615f4e3d2c1b0

The receiving system can decrypt using the same key. The format is iv:ciphertext.

4Base64 encode for API compatibility

Encode credentials in Base64 for HTTP Basic Authentication.

Algorithm: Base64 Encode
Input: api_user:api_password
Result
YXBpX3VzZXI6YXBpX3Bhc3N3b3Jk

Use the result in a Send Webhook header: Authorization: Basic YXBpX3VzZXI6YXBpX3Bhc3N3b3Jk

Output Fields

FieldTypeDescription
optihub_successBooleantrue if the operation completed successfully
resultStringThe hash, ciphertext, or encoded/decoded output
optihub_errorStringError message if the operation failed

Security Considerations

Hashing is one-way. MD5, SHA-1, SHA-256, and SHA-512 produce irreversible output. You cannot recover the original data from a hash.

Encryption is two-way. AES-256 encrypted data can be decrypted with the same key. Protect your encryption keys.

Base64 is encoding, not encryption. Anyone can decode Base64 data. Do not use Base64 alone to protect sensitive information.

Use SHA-256 or better. MD5 and SHA-1 have known vulnerabilities and should not be used for security-critical applications.

Secret keys are stored encrypted. All AuPerate Secrets are encrypted with AES-256-GCM and only decrypted in memory during execution.

Need help?

Check out our other documentation or get in touch.

Contact Us