Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- md5(), sha1() and sha512() return 16, 20 and 64 bytes respectively; their return type is Bytes, not a hexadecimal string.
- encode_base64() defaults to the standard Base64 alphabet without padding; u selects the URL-safe alphabet, p adds padding, and up combines both.
- The documented scope for encode_base64() is request/response header Transform Rules. The new hashes’ plans, fees, country availability, account-by-account rollout and full phase scope are unspecified.
- The Enterprise add-on and Transform Rules rewrite notes for sha256() apply to sha256() only and should not be carried over to the new functions.
The new functions return bytes; encode them when text is required
Cloudflare announced md5(), sha1() and sha512() for Rules on November 12, 2026. They accept a string or byte array and return raw bytes. If the receiver requires Base64 text, combine the hash with encode_base64().
The announcement describes these functions for systems that require the corresponding algorithms. An announced function does not establish availability for every account or rule execution phase; check plans and scope separately.
How many bytes does each function return?
md5() returns 16 bytes, sha1() returns 20 bytes, and sha512() returns 64 bytes. Each return type is Bytes, not a hexadecimal string.
Those lengths describe the digest itself. After Base64 encoding, the transmitted text length and trailing padding depend on the encoding options. Do not treat the digest byte count as the string length.
Base64 omits padding by default: what do u and p control?
encode_base64() accepts a String or Bytes value and defaults to the standard Base64 alphabet without padding. Padding adds = characters at the end so the output length is a multiple of four. Some receiving systems require it.
The optional flags argument is a single string: u selects the URL-safe alphabet, using - and _ instead of + and /; p adds = padding; and up combines both. Alphabet and padding options change the text representation, not the hash algorithm selected in the preceding step.
Combining the functions and checking rule scope
Standard alphabet without padding: encode_base64(sha512("hello world")).
Standard alphabet with padding: encode_base64(sha512("hello world"), "p"). URL-safe alphabet with padding: encode_base64(sha512("hello world"), "up").
These are expression examples and were not run in a live account. Cloudflare explicitly limits encode_base64() to request/response header Transform Rules. That restriction is not a complete support list for the new hash functions across products and execution phases.
Check format and account requirements before changing a rule
Compare the input bytes, hash algorithm, output encoding, alphabet and padding requirements with the receiving system. Use a non-sensitive sample to compare results against its exact contract before deciding whether to change a live configuration.
The announcement and new function entries do not state exact plans, additional fees, country coverage, account-by-account availability or full execution-phase support. Confirm the specific function and rule type in your current account and the official documentation.
The existing sha256() entry requires an Enterprise add-on and a specific entitlement, and limits that function to rewrite expressions in Transform Rules. Those notes are specific to sha256(); they do not establish permissions or scope for md5(), sha1() or sha512().
Sources
Frequently Asked Questions
Can I use Base64 when the protocol requires a hexadecimal string?
Do not treat the two text formats as interchangeable. encode_base64() produces a Base64 representation, and the references used here do not document a hexadecimal conversion method. Check the supported Cloudflare functions and the receiving protocol instead of substituting Base64 directly.
Does the u flag also percent-encode a URL?
No. The documented u flag only selects the URL-safe Base64 alphabet, using - and _ instead of + and /. It is not a URL percent-encoding step. If you place the result in a URL, check the surrounding URL syntax separately.