SSL Pinning Hash Generator
Generate Subject Public Key Info (SPKI) SHA-256 certificate pins. Export configs for Android network_security_config.xml, iOS TrustKit, Flutter, and OkHttp.
Certificate & Domain Details
Enter target API domain and Subject Public Key Info (SPKI) SHA-256 pin.
<!-- res/xml/network_security_config.xml -->
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config>
<domain includeSubdomains="true">api.example.com</domain>
<pin-set expiration="2027-12-31">
<pin digest="SHA-256">C5+lpZ7tcVwmwQIMcRtPbsQtWLABXhQzejna0wHFr8M=</pin>
<!-- Always configure a backup pin to avoid bricking app on cert rotation -->
<pin digest="SHA-256">r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E=</pin>
</pin-set>
</domain-config>
</network-security-config>
Defending Mobile Apps Against Man-In-The-Middle (MITM) Attacks
SSL/TLS Public Key Pinning (HPKP / SPKI Pinning) is a critical mobile and client-side security practice that associates a host with its expected public key certificate. Pinning the Subject Public Key Info (SPKI) rather than the entire certificate allows organizations to renew or rotate leaf certificates without breaking mobile app connectivity, so long as the same private key pair is preserved.
Key Technical Features
SPKI SHA-256 Cryptographic Hash Engine
Computes exact Base64 and Hex SHA-256 hashes of the Subject Public Key Info block compliant with RFC 7469.
Android Network Security Config Exporter
Outputs clean <pin-set> XML tags ready to drop into res/xml/network_security_config.xml.
iOS TrustKit & URLSession Exporter
Generates Swift and Objective-C pinning dictionaries for iOS mobile apps.
OkHttp & Retrofit Pinning Snippets
Provides Java and Kotlin CertificatePinner.Builder code for Android network clients.
Flutter & React Native Security Snippets
Outputs native HTTP client pinning configurations for cross-platform mobile frameworks.
Major CA & Custom Key Presets
Pre-loaded with verified SPKI pins for DigiCert Global Root, Let's Encrypt ISRG Root X1, and Google Trust Services.
Engineering & DevOps Scenarios
- ✓Mobile App Developers (iOS & Android)
Prevent rogue CA compromise and MITM proxy tools like Charles or Burp Suite from intercepting sensitive API traffic.
- ✓FinTech & Banking Security Teams
Comply with MAS, PCI-DSS, and Open Banking security standards requiring certificate pinning on mobile endpoints.
- ✓DevOps & Infrastructure Engineers
Calculate backup backup pins for key rotation before releasing new mobile builds to app stores.
- ✓Security Penetration Testers
Verify that target mobile applications correctly enforce public key pinning rules.
Frequently Asked Questions
Why pin the Public Key (SPKI) instead of the whole certificate?
Pinning the full certificate (the Subject Certificate) causes your app to break as soon as the certificate expires and is renewed. Pinning the Subject Public Key Info (SPKI) allows you to re-issue certificates with new expiration dates using the same private key without breaking older versions of your mobile app.
Why should I always configure a backup pin?
Both Google and Apple strongly recommend configuring at least one backup pin (such as your intermediate CA or an offline backup key pair). If your primary private key is compromised or needs urgent rotation, having a pre-pinned backup prevents your app from being locked out of server communications.
How do I extract the public key from an existing domain via OpenSSL?
You can run: openssl s_client -connect example.com:443 | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
Does certificate pinning work with modern Android 14+?
Yes. Android uses declarative network security configs via network_security_config.xml, which strictly enforces certificate pins across all system HTTPS connections.
Related Developer Tools
Need a Brain Break? ☕
Done working on your task? Take a quick 60-second break, test your reflexes, and flap through infinite pixel obstacles in Sky Flap!