How to Chain Encoding and Hashing Workflows

Problem

You need to process data through multiple encoding and hashing steps — for example, decode base64, compute a SHA-256 hash of the decoded bytes, and express the hash as a hex string — but you are unsure how to chain the tools correctly and verify each stage's output type compatibility.

Prerequisites

• Understanding of base64 encoding and decoding
• Familiarity with hash functions (SHA-256, HMAC)
• Knowledge of hex encoding for binary output
• Experience with the workflow engine and toolchain page

Steps

1. 1. Build a base64 → hash → hex verification chain

   Start with a base64-encoded payload. First, decode it with base64-encode (decode mode) to recover the raw bytes. Next, feed those bytes into the hash tool with algorithm set to SHA-256 — the output is a 32-byte binary digest. Finally, pass the digest through hex-encode to get a 64-character hex string suitable for display and comparison. This three-node chain lets you verify data integrity end-to-end: if the hex digest matches a known value, the original base64 payload is intact. The workflow recipe base64-encode-decode-verify automates the encode/decode round-trip portion; you extend it by appending a hash node and a hex-encode node. Check type compatibility at each boundary: base64-encode outputs binary, hash accepts binary and outputs binary, hex-encode accepts binary and outputs text.

   Input

   base64: SGVsbG8gV29ybGQ=

   Output

   SHA-256 hex: 872e4e50ce5f1f0d3b4e7d8e2f1a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1

2. 2. Run parallel multi-algorithm integrity verification

   Instead of hashing with a single algorithm, compute multiple hashes in parallel to increase confidence and enable cross-tool verification. Feed the same input bytes into the hash tool three times with different algorithms: MD5 (for legacy compatibility only — not for security), SHA-256 (general purpose), and SHA-3-256 (resistance to length-extension attacks). Compare each result against reference values. If all three match, the data integrity is confirmed with high assurance. If MD5 matches but SHA-256 does not, you have a collision or corruption — investigate further. This pattern is useful when migrating between hash algorithms: compute both old and new hashes during the transition period and verify they both match their respective references. Use the hmac-generator tool instead of plain hash when you need authenticated integrity — HMAC-SHA-256 proves both data integrity and authenticity with a shared secret key.

   Input

   Input bytes: 48 65 6C 6C 6F 20 57 6F 72 6C 64

   Output

   MD5: b10a8db164e07546 | SHA-256: 872e4e50... | SHA-3-256: 6c9be2c9...

3. 3. Create an automatic encoding-format conversion chain

   Sometimes you receive data in one encoding format and need it in another for downstream processing. Build a conversion chain: start with hex-encoded input, decode it with hex-encode (decode mode) to raw bytes, then re-encode with base64-encode to get a base64 string. This is useful when a system expects base64 but your source provides hex. The reverse chain (base64 → raw bytes → hex) is equally common. For text encoding conversions (UTF-8 to UTF-16, for example), use the dedicated unicode conversion tools. The key principle: always pass through the raw byte representation as the intermediate format, never convert directly between two encoded representations without decoding first — direct conversion is error-prone and loses type information. Verify the round-trip by converting back to the original format and comparing.

   Input

   hex: 48656c6c6f

   Output

   base64: SGVsbG8=

4. 4. Choose between inline chaining and saved workflow recipes

   For one-off tasks, chain tools inline on the toolchain page — it is fast and lets you inspect each intermediate output. For repeated tasks, save the chain as a workflow recipe so you can re-run it with different inputs without rebuilding the pipeline. The existing recipe hmac-sign-verify is a good template: it signs input with HMAC-SHA-256 and verifies the signature in one reproducible step. To create your own recipe, define the nodes array with each toolId and its params, add a sampleInput and sampleOutput for documentation, and test it with the recipes test suite. Use inline chaining when you need to debug intermediate values; use a saved recipe when the chain is stable and you want reproducibility and sharing via the serialize link.

   Input

   Decision: repeatable task with fixed steps

   Output

   Save as workflow recipe with sampleInput/sampleOutput for test coverage

Expected result

A working multi-step pipeline that chains encoding and hashing tools with verified type compatibility at each boundary, plus an understanding of when to use inline chaining versus a saved workflow recipe for reproducibility.

Common errors

Feeding a text string into a tool that expects binary bytes

Check the tool's input type. If it expects binary, encode the text first (e.g., base64 or hex) or use the text-to-bytes conversion. The workflow engine's type compatibility check (areTypesCompatible) will flag this at build time.

Comparing hex digests case-insensitively when the reference uses a different case

Normalize both to lowercase (or uppercase) before comparing. Hex encoding is case-insensitive by spec, but string comparison is case-sensitive. Use a consistent convention.

Using MD5 in a security-sensitive integrity check

MD5 is broken and vulnerable to collision attacks. Use SHA-256 or SHA-3 for any security-relevant verification. MD5 is acceptable only for non-security checksums or legacy compatibility.

Forgetting to verify the round-trip after an encoding conversion

Always convert back to the original format and compare with the source. If they differ, the conversion chain has a bug — typically a wrong intermediate type or an encoding that is not bijective for your input.

Troubleshooting

• If the workflow engine rejects your chain with a type incompatibility error, inspect each node's declared inputType and outputType in the tool definition. Insert a conversion node (e.g., hex-encode) where text and binary meet.
• If the final hash does not match the reference but intermediate outputs look correct, check for trailing whitespace or newline differences — base64 decoders sometimes append or strip line breaks.
• If HMAC verification fails but the data is correct, verify the shared secret key is identical on both sides and that the same hash algorithm is used (HMAC-SHA-256 vs HMAC-SHA-1 are not interchangeable).
• If a saved workflow recipe fails on new input but worked on the sample, check whether the new input has a different type or encoding than the sample — recipes do not auto-convert input types.

Security limits

• Never use MD5 or SHA-1 for security-sensitive integrity verification. They are broken and vulnerable to collision attacks.
• HMAC keys are processed locally and never transmitted. Treat the HMAC key with the same care as a password — store it securely and never include it in shared workflow links.
• All encoding and hashing operations run locally in the browser or a Web Worker — no data is sent to any server.