> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://rivet.chrisboulton.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://rivet.chrisboulton.com/_mcp/server.

# Hash and crypto functions

> Signatures, behavior, examples, and Rivet compatibility boundaries.

Text hashes operate on the supplied UTF-8 bytes. File hashes read confined regular files as raw bytes; they follow the [filesystem confinement rules](/language/functions/filesystem).

| Function                              | Result and rules                                                                                                      |
| ------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `md5(text)`                           | Lowercase hex MD5 digest.                                                                                             |
| `sha1(text)`                          | Lowercase hex SHA-1 digest.                                                                                           |
| `sha256(text)`                        | Lowercase hex SHA-256 digest.                                                                                         |
| `sha512(text)`                        | Lowercase hex SHA-512 digest.                                                                                         |
| `base64sha256(text)`                  | Base64 of raw SHA-256 digest bytes, not of the hex spelling.                                                          |
| `base64sha512(text)`                  | Base64 of raw SHA-512 digest bytes.                                                                                   |
| `filemd5(path)`                       | Lowercase hex MD5 of file bytes.                                                                                      |
| `filesha1(path)`                      | Lowercase hex SHA-1 of file bytes.                                                                                    |
| `filesha256(path)`                    | Lowercase hex SHA-256 of file bytes.                                                                                  |
| `filesha512(path)`                    | Lowercase hex SHA-512 of file bytes.                                                                                  |
| `filebase64sha256(path)`              | Base64 of raw SHA-256 digest bytes of a file.                                                                         |
| `filebase64sha512(path)`              | Base64 of raw SHA-512 digest bytes of a file.                                                                         |
| `rsadecrypt(ciphertext, private_key)` | Base64 PKCS#1 v1.5 ciphertext plus unencrypted PKCS#1/PKCS#8 PEM RSA key; UTF-8 plaintext is intrinsically sensitive. |
| `uuidv5(namespace, name)`             | Deterministic namespace UUID; namespace is a UUID or dns/url/oid/x500.                                                |

`rsadecrypt` accepts keys up to 8192 bits/16 KiB. Keep key material out of public configurations; use sensitive inputs when required. Sensitivity does not encrypt a completed bundle. Random `uuid` and `bcrypt` functions are unavailable. Bundle integrity and cloud file checksums use SHA-256; legacy hash functions do not change those policies.

## Example

```hcl
locals {
  hashes = {
    md5 = md5("rivet")
    sha1 = sha1("rivet")
    sha256 = sha256("rivet")
    sha512 = sha512("rivet")
    base64sha256 = base64sha256("rivet")
    base64sha512 = base64sha512("rivet")
    filemd5 = filemd5("assets/config.json")
    filesha1 = filesha1("assets/config.json")
    filesha256 = filesha256("assets/config.json")
    filesha512 = filesha512("assets/config.json")
    filebase64sha256 = filebase64sha256("assets/config.json")
    filebase64sha512 = filebase64sha512("assets/config.json")
    id = uuidv5("dns", "example.invalid")
  }
}
output "hashes" {
  type  = string
  value = jsonencode(local.hashes)
}
```

All calls obey the [function limits and annotation rules](/language/functions).