Is there a way to generate a sha256 HMAC hash in scriptable?

A couple of APIs require signing a request with a sha256 HMAC hash of some sort. Is there a way to create something like that in scriptable?

I don’t believe the Javascript runtime provided by Apple includes cryptographic primitives and looking at docs.scriptable.app it doesn’t look like scriptable provides a separate API for that. A quick search showed Forge as the most reliable crypto library for JS which can be installed using NPM

As far as I know, Scriptable doesn’t support node.js, so I’m not sure how Forge would help here unless you can run it through something like Browserify first?

I would suggest first trying the solution suggested when this question was posted previously.

I’ve just tried using the module I linked to download Forge and it worked! I think as long as the library isn’t using node specific apis, JavaScript libraries from npm/Cdn’s should be usable in Scriptable

1 Like

How exactly are you installing/ using this? could you provide an example maybe?

I followed the directions I linked above link to be able to save npm modules in scriptable.

I then ran


const require = importModule("require");

// also accepts `forceDownload` to always use online version
const _ = await require({ moduleName: "forge", url: "https://unpkg.com/node-forge@0.7.0/dist/forge.min.js" });

Which installs forge


const forge = importModule("forge");


var md = forge.md.sha1.create();
md.update('The quick brown fox jumps over the lazy dog');
console.log(md.digest().toHex());

To prove it works.

This is the example from the read me on GitHub

Hi, it looks like the npm downloader i had installed was not what I linked to. I’ve redone the process using the actual script I linked to. Sorry!

  1. Copy this script which I named “NPM Downloader” but you can call anything
  2. In a new script file in Scriptable I wrote this
// this would be whatever you name the above script 
const require = importModule("NPM Downloader")

const forge = await require("node-forge@0.7.0", true);


var md = forge.md.sha1.create();
md.update('The quick brown fox jumps over the lazy dog');
console.log(md.digest().toHex());

For what it’s worth, this Shortcut generates a HMAC SHA256 hash without using scriptable.

https://www.icloud.com/shortcuts/df729acb77d347a0b0c6fe6b876f405d

1 Like

As wzrd.in is probably dead for good, the NPM Downloader option doesn’t work anymore.

What I did to have to the Crypo-js available in Scritable is:

  • mkdir /tmp/crypto && cd /tmp/crypto
  • npm install crypto-js
  • npx browserify -s crypto --bare node_modules/crypto-js/index.js -o crypto.js

You’ll then have a crypto.js file that you can put inside your Scriptable folder and you’ll be able to use it:

const crypto = importModule("crypto");

const sign = crypto.enc.Base64.stringify(crypto.HmacSHA256('my data, 'my secret))