Batch checksums, webhook signatures and decoding recipes

Open the template Release integrity & webhook signatures.

1. One published checksum

readme.txt (published SHA-256) hashes the text usefulweb.site checksum demo (with its trailing newline) and compares it with the Expected value (published checksum or signature). Keysmith accepts hex with spaces or colons and Base64. SHA-256 runs on this device, so Compute and compare says Match (SHA-256).

The second item, readme.txt from a mirror (tampered), contains one extra character. The result is a critical finding: The input does not match the expected value …

Algorithms marked (server) — MD5, SHA-3, BLAKE2, CRC-32 — use the Hash & HMAC Calculator on the server; for files Keysmith asks first.

2. A webhook signature

Webhook signature (HMAC-SHA256) uses the example from GitHub's webhook documentation: payload Hello, World!, secret It's a Secret to Everybody, expected signature 757107ea…3e17. Because an HMAC key is set, Keysmith computes an HMAC instead of a hash — locally — and reports a match. Change one character of the payload to see how a forged request would look.

3. Verify a whole release

Add Add → Checksum or signature check, switch Input to File and choose all files of the release at once. Open Batch: verify many files against checksum lines and paste the SHA256SUMS file:

cfa892addd30ff8c6453d2f3b44c88c363b38a3fb511335739a5067f555be6c0  readme.txt

Press Verify files against checksum lines. Files are matched by name and hashed on this device; the algorithm follows from the checksum length (SHA-1, SHA-256, SHA-384, SHA-512). The Files table lists matches, does not match, file not chosen or not verified per line, and the findings name every mismatch. Download batch CSV exports the table with the actual values.

Dropping a SHA256SUMS file onto Keysmith creates such an item for you.

4. Decode and verify a JWT

Decode a JWT from the logs runs the CyberChef-lite preset Decode a JWT; Verify the JWT signature (HS256) runs the Crypto Kitchen recipe jwt-verify key=@key alg=HS256 with the secret in Secret key (@key). Both are server tools, so Keysmith asks before sending the token.

5. Batch decoding

Open Token & payload forensics and select Log lines: URL decode twice (batch). Batch rows (one input per line) holds three doubly encoded values. Run over all batch rows decodes every line with the same recipe, waits for the API rate limit when necessary and shows Batch: 3 of 3 rows decoded. — for example name=Jürgen Müller&city=Köln. Download batch CSV gives you row, input, output and status. Up to 200 rows per batch; the run history keeps only the counts, never the decoded data.