Crypto

Beta Feature: This node is currently in beta. Features and functionality may be subject to changes.

The Crypto Node performs cryptographic operations within your workflow. It supports symmetric encryption/decryption, asymmetric signing/verification, HMAC generation/verification, and hashing.

Supported operations:

Operation	Description
Encrypt	Symmetric encryption using AES-256 (GCM or CBC mode)
Decrypt	Symmetric decryption using AES-256
Sign	Asymmetric digital signature using RSA-PSS or ECDSA
Verify	Verify a digital signature against a public key
HMAC	Generate a keyed-hash message authentication code
Hash	Compute a one-way cryptographic hash digest

How Does It Work?

Setup Steps:

Build your workflow using Graph Edit Mode (minimum setup: input node → crypto node → output node, but you can add more nodes as needed)
Click on the crypto node settings to open its configuration
Select the operation you want to perform
Configure the operation-specific fields (algorithm, keys, data, encodings)

Common Fields:

All operations share these fields:

Field	Description	Default
`operation`	The cryptographic operation to perform: `encrypt`, `decrypt`, `sign`, `verify`, `hmac`, or `hash`	—
`data`	The input data to process. Accepts `{{{mustache}}}` templates	—
`inputEncoding`	Encoding of the input data	`utf8` (encrypt/sign/hmac/hash), `base64` (decrypt)

Tip: All string fields accept {{{mustache}}} templates to reference data from upstream nodes.

Operations

Encrypt

Symmetric encryption using AES-256. Supports GCM (authenticated, recommended) and CBC modes.

GCM mode generates a random 12-byte IV and produces { data, iv, authTag } — all three are needed for decryption.
CBC mode generates a random 16-byte IV and produces { data, iv }. With padding none, input length must be a multiple of 16 bytes.

Fields:

Field	Description	Default
`algorithm`	`aes-256-gcm` (recommended) or `aes-256-cbc`	`aes-256-gcm`
`key`	AES-256 key — must be exactly 32 bytes, provided as hex (64 chars) or base64. Sensitive — use `{{{$env.ENCRYPTION_KEY}}}`	—
`padding`	`pkcs7` or `none` (CBC only; input must be multiple of 16 bytes). Only shown when algorithm is `aes-256-cbc`	`pkcs7`
`inputEncoding`	`utf8`, `base64`, or `hex`	`utf8`

Output (base64-encoded):

{
  "data": "k7x9QmZ3R2hJNmFi...",
  "iv": "YWJjZGVmZ2hpamts",
  "authTag": "dGFnMTIzNDU2Nzg5MGFi"
}

authTag is only present when using aes-256-gcm.

Decrypt

Symmetric decryption using AES-256. Reverses the encrypt operation.

GCM mode requires the iv (12 bytes) and authTag from the encrypt output. Fails if authentication fails (data has been tampered).
CBC mode requires the iv (16 bytes). With padding none, ciphertext length must be a multiple of 16 bytes.

Fields:

Field	Description	Default
`algorithm`	Must match the algorithm used for encryption: `aes-256-gcm` or `aes-256-cbc`	`aes-256-gcm`
`key`	Same key used for encryption. Sensitive — use `{{{$env.ENCRYPTION_KEY}}}`	—
`iv`	Initialization vector from the encrypt output. Template from upstream: `{{{iv}}}`	—
`authTag`	Authentication tag from GCM encryption. Required for `aes-256-gcm`. Template: `{{{authTag}}}`. Only shown when algorithm is `aes-256-gcm`	—
`padding`	`pkcs7` or `none` (must match encryption padding, CBC only). Only shown when algorithm is `aes-256-cbc`	`pkcs7`
`inputEncoding`	`utf8`, `base64`, or `hex`	`base64`

Output (UTF-8 decoded):

{
  "data": "original plaintext string"
}

Sign

Asymmetric digital signature using RSA-PSS or ECDSA. Signs data with a private key to produce a signature verifiable with the corresponding public key.

Fields:

Field	Description	Default
`algorithm`	`rsa-pss-sha256`, `rsa-pss-sha512`, `ecdsa-sha256`, or `ecdsa-sha512`	`rsa-pss-sha256`
`privateKey`	PEM-formatted private key (must include `-----BEGIN PRIVATE KEY-----` header). Sensitive — use `{{{$env.PRIVATE_KEY}}}`	—
`inputEncoding`	`utf8`, `base64`, or `hex`	`utf8`

Output (base64-encoded):

{
  "signature": "MEUCIQC7x2f3nF..."
}

Verify

Verify a digital signature against a public key. Returns whether the signature is valid for the given data.

Fields:

Field	Description	Default
`algorithm`	Must match the signing algorithm: `rsa-pss-sha256`, `rsa-pss-sha512`, `ecdsa-sha256`, or `ecdsa-sha512`	`rsa-pss-sha256`
`publicKey`	PEM-formatted public key (must include `-----BEGIN PUBLIC KEY-----` header)	—
`signature`	The signature to verify (base64-encoded). Template from upstream sign node: `{{{signature}}}`	—
`inputEncoding`	`utf8`, `base64`, or `hex`	`utf8`

Output:

{
  "valid": true
}

HMAC

Generate a keyed-hash message authentication code (HMAC) for message signing and integrity verification.

Fields:

Field	Description	Default
`algorithm`	`sha256` or `sha512`	`sha256`
`key`	HMAC secret key (any string length). Sensitive — use `{{{$env.HMAC_KEY}}}`	—
`inputEncoding`	`utf8`, `base64`, or `hex`	`utf8`

Output (base64-encoded):

{
  "mac": "nF3DnKGtEh8r0oKz..."
}

Hash

Compute a one-way cryptographic hash digest. No key is required.

Fields:

Field	Description	Default
`algorithm`	`sha256` or `sha512`	`sha256`
`inputEncoding`	`utf8`, `base64`, or `hex`	`utf8`

Output (hex-encoded):

{
  "hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
}

Examples

Encrypting and Decrypting Data

A common pattern is to encrypt sensitive data in one node and decrypt it later in the workflow.

Encrypt node configuration:

Field	Value
Operation	`encrypt`
Algorithm	`aes-256-gcm`
Key	`{{{$env.ENCRYPTION_KEY}}}`
Data	`{{{sensitivePayload}}}`
Input Encoding	`utf8`

Encrypt output:

{
  "data": "k7x9QmZ3R2hJNmFi...",
  "iv": "YWJjZGVmZ2hpamts",
  "authTag": "dGFnMTIzNDU2Nzg5MGFi"
}

Decrypt node configuration (referencing the encrypt node output):

Field	Value
Operation	`decrypt`
Algorithm	`aes-256-gcm`
Key	`{{{$env.ENCRYPTION_KEY}}}`
Data	`{{{data}}}`
IV	`{{{iv}}}`
Auth Tag	`{{{authTag}}}`
Input Encoding	`base64`

Decrypt output:

{
  "data": "original sensitive payload"
}

Generating HMAC for Webhook Signing

Use HMAC to generate a message authentication code for signing outgoing payloads.

Node configuration:

Field	Value
Operation	`hmac`
Algorithm	`sha256`
Key	`{{{$env.WEBHOOK_SECRET}}}`
Data	`{{{rawPayload}}}`

Output:

{
  "mac": "nF3DnKGtEh8r0oKzV5mXqA..."
}

The mac value can be passed as a signature header in a subsequent API node call.

Hashing Data for Integrity Check

Node configuration:

Field	Value
Operation	`hash`
Algorithm	`sha256`
Data	`{{{documentContent}}}`

Output:

{
  "hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
}

Security Best Practices

Never hardcode keys in node configuration. Always use environment variable references ({{{$env.KEY_NAME}}}) for sensitive fields like key, privateKey, and HMAC secrets.

Use GCM over CBC — aes-256-gcm provides authenticated encryption which detects data tampering. CBC does not.
AES-256 key size — Keys must be exactly 32 bytes. Provide as a 64-character hex string or base64-encoded. The runtime auto-detects the format.
PEM key format — Sign/verify keys must include proper PEM headers (-----BEGIN PRIVATE KEY-----, -----BEGIN PUBLIC KEY-----). Both RSA and EC keys are supported.
HMAC vs Hash — Use HMAC (keyed) when you need to prove authenticity. Use Hash (unkeyed) only for checksums or fingerprinting where no secret is involved.
CBC padding — When using padding: "none" with CBC mode, ensure input data length is a multiple of 16 bytes or the node will throw an error.

When to Use It?

Use Crypto Node when:

You need to encrypt sensitive data before storing or transmitting it
You need to decrypt data received from an external system
You need to sign data to prove authenticity (e.g., signing a request to a partner API)
You need to verify a signature from an external source
You need to verify webhook signatures using HMAC
You need to compute a hash for data integrity or deduplication

Convert

Databricks