Resources · n8n integration

n8n Crypto nodeConfigure Crypto in n8n.

The n8n Crypto node turns a value into a hash, a signature or an encrypted string without leaving the workflow. A single parameter drives it, Action, with six choices from Hash to Sign. It runs on every incoming item, so the result sits in the data before the next node reads it.

Try the Crypto node on n8nSee the 1 parameters

Verified Trustpilot reviews · AI, automation & growth agency

Why automate

What does the n8n Crypto node do in a workflow?

Crypto is a core node shipped with n8n. It applies one cryptographic operation to the items flowing through it and writes the result into a property you name. Hashing, Hmac, signing, encryption, decryption and random string generation all live behind the same Action selector, so the node you drop on the canvas is the same one whether you need a checksum or an AES ciphertext.

Start with the case most people land here for: an incoming request you have to trust. The sender computes an Hmac over the body, that is a hash mixed with a shared secret, and puts it in a header. You recompute it with Action set to Hmac, SHA256 under Type and hex under Encoding, then compare the two strings. A Webhook node sits in front, because Crypto never opens a workflow by itself.

Second scenario, deduplication. A row or a file arrives and you want one stable fingerprint instead of comparing a dozen fields by hand. Hash collapses the payload into a short string you can store next to the record. Write it to a unique column in Postgres and the second run stops on its own, or park it in a column of Google Sheets and filter on it later. Switch Binary File on and the fingerprint covers an attachment instead of text.

Third, the throwaway values every integration ends up needing. Generate returns a random string as ascii, base64, hex or uuid, which covers one time links, idempotency keys and correlation ids passed to an API through HTTP Request. Sign covers the other half: a private key produces a signature a partner can check against your public key.

When is another node the better answer? Crypto computes locally on the item. If the signature has to be produced or verified by a remote service, the call belongs to HTTP Request, which reaches any HTTP endpoint. Crypto is also not a transport: it prepares a value, something else has to move it.

The limits worth knowing before you build. Asymmetric RSA mode only encrypts small payloads, around 190 bytes with a 2048-bit key, so anything larger goes through symmetric mode. Cipher has to match exactly between the encrypt run and the decrypt run, and Length only applies when Generate is set to ASCII, BASE64 or HEX. Version 2 of the node is described here, and an older workflow can still show an earlier version with fewer options. Teams who want the reasoning behind these patterns walk through them in our n8n training.

Connect

How do you set up Crypto credentials in n8n?

  1. 01

    Check which action needs the credential

    Only two of the six actions require a Crypto credential: Hmac and Sign. On those two the node refuses to run until a credential is selected. Hash and Generate compute on the item alone and ask for nothing. The same credential also holds the encryption fields, so one creation covers every Crypto node in the instance.

  2. 02

    Create the credential and fill only what you use

    Open the Credentials menu in n8n and create a Crypto credential. Every field in it is optional, so fill the ones your action needs: Hmac Secret for the Hmac action, Private Key for Sign, Encryption Passphrase for the symmetric mode of Encrypt and Decrypt, Encryption Public Key and Encryption Private Key for the asymmetric one.

  3. 03

    Select it in the node before the run

    Back on the canvas, open the Crypto node, pick the credential in its dropdown and set Action to Hmac or to Sign. The secret lives in the credential rather than in the panel, so a workflow you export or hand over carries none of it. Hash and Generate keep working whether a credential is selected or not.

Parameters

Which parameters does the Crypto node expose?

The Crypto node has one parameter. For each one: the node as you configure it in n8n, what the parameter changes, and our field notes.

01

Action

action

What you see in n8n

Notes & use cases

One top level selector decides what the node does and which fields the panel shows underneath it.

Key parameters

  • Action: hash, hmac, sign, encrypt, decrypt or generate.
  • Value and Property Name: the input, often {{ $json.body }}, and the property the result is written to.
  • Type and Encoding: hash types from MD5 to SHA512, output as base64 or hex.
  • Binary File with Binary Property Name: work on an attachment instead of text.
  • Mode and Cipher: symmetric with aes-256-gcm, or asymmetric RSA.
  • Algorithm Name or ID for Sign, Type and Length for Generate.
Use cases
a checksum on an invoice file, or a signed body a partner API can verify.
Need help

Need help automating Crypto with n8n?

A person reads every message.

FAQ

Crypto node questions, answered

01Is the Crypto node included in n8n?
Yes. Crypto is a core node, shipped with n8n itself. There is nothing to install, nothing to buy, and it behaves the same on n8n Cloud, the hosted offer run by n8n, as on an instance you host yourself with Docker or npm under the Community Edition and its Sustainable Use licence. A workflow built in one place runs in the other. The node adds no cost of its own because the cryptography happens inside your n8n instance, on the items already flowing through the workflow. The only thing you supply is the data and, for Hmac and Sign, the Crypto credential they read their secret from.
02What do you need to set up before the n8n Crypto node works?
Two of the six actions require a Crypto credential, the other four do not. Hmac and Sign need one: with no credential selected, the node does not run on those actions. Hash and Generate compute on the item alone. The credential itself is created once in the Credentials menu and all of its fields are optional: Hmac Secret for the Hmac action, Private Key for Sign, Encryption Passphrase for Encrypt and Decrypt in symmetric mode, Encryption Public Key and Encryption Private Key in asymmetric mode. You fill only the ones your action uses. There is still no OAuth screen and no external service to authorize, since the maths happens inside your instance.
03What are the limits of the Crypto node?
Three matter in practice. Asymmetric RSA mode encrypts small payloads only, roughly 190 bytes with a 2048-bit key, so large values have to go through symmetric mode with one of the four authenticated ciphers, AES-256-GCM, AES-192-GCM, AES-128-GCM or ChaCha20-Poly1305. The cipher chosen on encrypt has to be selected again on decrypt, otherwise the value never comes back. And Length only applies to Generate when the type is ASCII, BASE64 or HEX, since UUID has a fixed shape. The page describes version 2 of the node, and an older workflow may still display a version with fewer options.
04Crypto node or HTTP Request for signing a payload?
It depends on where the secret lives. When the key or the passphrase is yours and the maths can happen inside the workflow, Crypto is the shorter path: one node, one action, the result written into a property of the item. When the signature has to be produced, validated or stamped by a remote service, that call is an HTTP call, and the HTTP Request node reaches any HTTP endpoint for it. The two also work together. Crypto builds the Hmac, HTTP Request sends the request with the header that carries it. Crypto is not a fallback for a missing API, it is a local operation on the data.
05n8n or Make for cryptographic steps?
Look at four criteria rather than a feature list. Hosting first: n8n runs on your own server with Docker or npm, or on n8n Cloud, while Make is hosted only. Data control follows from it, and it weighs more than usual here, since a passphrase or a private key stays inside the instance you run. Cost model next: Make bills per operation, which changes the arithmetic on workflows that hash every item of a large batch. Visual logic last: both draw the flow on a canvas, and the choice comes down to which one your team reads faster. Neither is wrong, the constraints decide.
Hack'celeration Lab

Get our weekly integration tips.

No spam. Unsubscribe anytime.

Same platform

Other docs you might need on this stack.

Browse all integrations