Hash toolkit

curl -s "https://api2.globus.studio/v2/hash?input=correct-horse&type=globus"

A hash toolkit API turns a string into digests of several kinds and marks which ones are fit for secrets. The useful part is the split: a checksum for comparing files, a slow hash for a password, and a keyed fingerprint for matching values across systems without storing them.

The hash toolkit returns that split explicitly, so a digest copied into the wrong place is a visible mistake rather than a quiet one.

What the hash toolkit returns

A hash toolkit call with one type returns the value. Ask for all and the answer groups the results by family.

{
    "input_length": 11,
    "hashes": {
        "standard": {"md5": "...", "sha1": "...", "sha256": "...", "sha512": "...", "crc32": "...", "adler32": "..."},
        "complex": {"sha3_256": "...", "whirlpool": "...", "bcrypt": "...", "argon2id": "..."},
        "globus": {"digest": "GS3$argon2id$v=19$m=65536,t=3,p=1$...", "fingerprint": "GS3F$...", "version": "3.0"}
    }
}

crc32 and adler32 are checksums. They catch a typo in a copied value and nothing else. md5 and sha1 are here because old systems still ask for them; for new work use sha256 or sha3.

Password hashes

The globus type is the one meant for passwords. It is Argon2id, the memory-hard function from RFC 9106, with a random salt per call. Parameters sit inside the string, so a hash issued today still verifies after you raise the cost.

curl -s "https://api.globus.studio/v2/hash?input=correct-horse&type=globus"

The answer is a PHC string with a version prefix:

GS3$argon2id$v=19$m=65536,t=3,p=1$c2FsdA$hash

m is memory in KiB, t is the iteration count, p is lanes. The prefix says which construction produced the value, the salt and the digest are base64, and password_verify() accepts the part after GS3 in PHP without any conversion.

In the hash toolkit, cost is adjustable per request with memory, time and threads. The default of 64 MiB and three passes takes about 100 ms on the current server. Raising memory raises the cost for an attacker with a GPU far more than it raises it for you, because a GPU has little memory per core. The response names the KDF that ran: on a host built without Argon2id the endpoint uses bcrypt with cost 12 over a SHA3-256 pre-hash, reports kdf and adds a warning field. Nothing is downgraded silently.

Checking a password

The hash toolkit verifies with a separate call. Send the stored value and the candidate, and the answer is a boolean with the algorithm name.

curl -s "https://api.globus.studio/v2/hash?verify=1&input=correct-horse&digest=GS3%24argon2id%24..."

{"valid": true, "algorithm": "argon2id", "format_ok": true}

The reply does not echo the input and does not repeat the parameters. That matters when the call runs in a log-heavy environment.

Fingerprints without storage

fingerprint is a keyed digest with no work factor. It is deterministic: the same input always gives the same value, so you can compare two records, deduplicate an import or build a stable cache key without keeping the original.

GS3F$1CA1A79C$895037AFB8C588EE172DC5E7110657ED$1F08

Do not put a fingerprint where a password hash belongs. It costs microseconds to compute, which is exactly what a password hash must not do. The endpoint says so in the field name and in the documentation, because the mistake is common and silent.

The old format

globus_legacy reproduces the previous GS$ scheme so values issued before 2026 can still be checked. It has no work factor and a salt derived from the calendar year, so every copy of the same input produced the same digest and the cost of a guess stayed flat. The response marks it deprecated; new values should use globus.

Limits

The hash toolkit is rate limited to 20 requests per minute per address, because each Argon2id call allocates 64 MiB. Six standard digests cost almost nothing; the password hash is the part that costs.

Which type to pick

For a file or a cache key, sha256 is the default choice and fingerprint is better when the input is a secret you would rather not keep. For a password, globus is the only correct type on the list: it carries a work factor and a salt that changes on every call.

standard and complex exist for compatibility and for one-off comparisons. They return many digests in one answer, which is handy when you are checking an old value and do not know which function produced it.

Related endpoints

For a random password that is safe to hand out, use the strong password generator. For WordPress keys and salts, the salt generator writes the block that belongs in wp-config.php.

Further reading: RFC 9106, Argon2 Memory-Hard Function and OWASP Password Storage Cheat Sheet.