Crypto & Compute

OcaltQL provides native cryptographic hashing, symmetric encryption and decryption, key generation, UUID generation, randomization, encoding, decoding, and advanced mathematical computation — all through clean dedicated verbs.

Hashing

GENERATE HASH FOR produces a cryptographic hash of a value. The algorithm is specified with AS. Supported algorithms: md5, sha1, sha256, sha384, sha512. HMAC variants are also supported: hmac-sha256, hmac-sha512, hmac-sha1, hmac-md5 (requires the KEY modifier). The result is always the digest written as lowercase hexadecimal text.

SHA256
STRING "hello world" SET ?input
AFTER GENERATE HASH FOR ?input AS sha256 SET ?hash
AFTER EMIT ?hash
Other Hash Algorithms
STRING "hello world" SET ?input
AFTER GENERATE HASH FOR ?input AS md5 SET ?md5
AFTER EMIT ?md5
AFTER GENERATE HASH FOR ?input AS sha1 SET ?sha1
AFTER EMIT ?sha1
AFTER GENERATE HASH FOR ?input AS sha512 SET ?sha512
AFTER EMIT ?sha512

An algorithm name is written exactly as listed, with its hyphen and without spaces or quotes: AS hmac-sha256. Written with spaces, hmac - sha256 is a subtraction, not a name.

HMAC

An HMAC is a hash that can only be produced by someone who holds the key, which is what makes it a signature. It is how a webhook proves where it came from and how most cloud APIs authenticate a request. KEY is required for every hmac- algorithm and is refused for the plain ones.

HMAC-SHA256
GENERATE HASH FOR "hello world" AS hmac-sha256 KEY "shared_secret_key" SET ?signature
AFTER EMIT ?signature
(* Output: 15873200bd3a9ef855ed49470d335ef21d26a493557556a7c26b6e355280437c *)

Text and Bytes

What is hashed is the value's bytes. A string is hashed as its UTF-8 bytes. A bytes value, such as a file read from the namespace, a FETCH response that is not text, or the result of DECODE ... AS HEX, is hashed as the bytes it holds, never as its printed form. The KEY follows the same rule, so a key may be text or raw bytes.

That rule is what makes chained signing possible. Some schemes derive a signing key in stages, each stage keyed with the raw digest of the one before. DECODE ... AS HEX turns a digest back into its raw bytes, ready to key the next stage. The example below derives an AWS Signature Version 4 signing key; its output is the value AWS publishes for these inputs.

Chained HMAC: an AWS SigV4 Signing Key
STRING "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY" SET ?secret
AFTER GENERATE HASH FOR "20150830" AS hmac-sha256 KEY "AWS4" & ?secret SET ?dateHex
AFTER DECODE ?dateHex AS HEX SET ?dateKey
AFTER GENERATE HASH FOR "us-east-1" AS hmac-sha256 KEY ?dateKey SET ?regionHex
AFTER DECODE ?regionHex AS HEX SET ?regionKey
AFTER GENERATE HASH FOR "iam" AS hmac-sha256 KEY ?regionKey SET ?serviceHex
AFTER DECODE ?serviceHex AS HEX SET ?serviceKey
AFTER GENERATE HASH FOR "aws4_request" AS hmac-sha256 KEY ?serviceKey SET ?signingKey
AFTER EMIT ?signingKey
(* Output: c4afb1cc5771d871763a393e44b703571b55cc28424d1a5e86da6ed3c154a4b9 *)

Encryption & Decryption

ENCRYPT applies symmetric encryption to a string using a key and a specified algorithm. DECRYPT reverses it. Supported algorithms: aes256, aes128. Both use AES-GCM with a fresh 12-byte IV per call, prepended to the ciphertext before base64 encoding. The key may be a generated key from GENERATE KEY, or any passphrase - a passphrase is derived to the required length with SHA-256, so "mykey" works as written without weakening a real key.

Encrypt
STRING "secret message" SET ?message
AFTER STRING "mykey" SET ?key
AFTER ENCRYPT ?message WITH ?key AS aes256 SET ?encrypted
AFTER EMIT ?encrypted
AFTER ENCRYPT ?message WITH ?key AS aes128 SET ?encrypted2
AFTER EMIT ?encrypted2
Decrypt
STRING "secret message" SET ?message
AFTER STRING "mykey" SET ?key
AFTER ENCRYPT ?message WITH ?key AS aes256 SET ?encrypted
AFTER DECRYPT ?encrypted WITH ?key AS aes256 SET ?decrypted
AFTER EMIT ?decrypted
(* Output: secret message *)

Key Generation

GENERATE KEY AS produces a cryptographic key for the specified algorithm. Supported: aes256 (32 bytes), aes128 (16 bytes). Keys are returned as base64 strings.

Generate Keys
GENERATE KEY AS aes SET ?aeskey
AFTER EMIT ?aeskey

UUID

GENERATE UUID produces a universally unique identifier.

UUID
GENERATE UUID SET ?id
AFTER EMIT ?id

Randomization

RANDOMIZE generates random numbers and strings. For numbers, specify a range and a type. For strings, specify a length and a character type. A custom charset can also be provided.

Random Numbers

Random Integer from Range
RANDOMIZE FROM RANGE 1 TO 100 AS integer SET ?rand
AFTER EMIT ?rand
Random Decimal
RANDOMIZE FROM RANGE 0 TO 1 AS decimal SET ?decimal
AFTER EMIT ?decimal
AFTER RANDOMIZE FROM RANGE 0 TO 1 AS decimal PLACES 5 SET ?precise
AFTER EMIT ?precise

Random Strings

Random String by Type
RANDOMIZE STRING LENGTH 16 AS alphanumeric SET ?token
AFTER EMIT ?token
AFTER RANDOMIZE STRING LENGTH 32 AS hex SET ?hex
AFTER EMIT ?hex
AFTER RANDOMIZE STRING LENGTH 8 AS numeric SET ?pin
AFTER EMIT ?pin
AFTER RANDOMIZE STRING LENGTH 24 AS uppercase SET ?upper
AFTER EMIT ?upper
AFTER RANDOMIZE STRING LENGTH 24 AS lowercase SET ?lower
AFTER EMIT ?lower
Random String from Custom Charset
STRING "abc123!@#" SET ?charset
AFTER RANDOMIZE FROM STRING ?charset LENGTH 16 SET ?custom
AFTER EMIT ?custom
AFTER RANDOMIZE FROM STRING ?charset SET ?custom2
AFTER EMIT ?custom2
(* Without LENGTH — defaults to the length of the charset string *)

Encoding & Decoding

ENCODE converts a string to a specified encoding format. DECODE reverses it. Supported formats: base64, hex, url.

DECODE returns bytes when the data is not text. Base64 or hex that decodes to valid UTF-8 comes back as a string. Anything else - a PNG, a PDF, a zip - comes back as a bytes value, OcaltQL's binary type: it prints as base64, sizes with LENGTH, indexes a byte at a time with ?b(0), and writes straight to disk with FILE WRITE "path" CONTENT ?b - no BASE64 modifier, it is already binary. ENCRYPT and DECRYPT carry bytes too, so a file can be encrypted and recovered byte-for-byte.
Encode
STRING "hello" SET ?text
AFTER ENCODE ?text AS base64 SET ?b64
AFTER EMIT ?b64
AFTER ENCODE ?text AS hex SET ?hexenc
AFTER EMIT ?hexenc
AFTER ENCODE ?text AS url SET ?urlenc
AFTER EMIT ?urlenc
Decode
STRING "hello" SET ?text
AFTER ENCODE ?text AS base64 SET ?b64
AFTER ENCODE ?text AS hex SET ?hexenc
AFTER DECODE ?b64 AS base64 SET ?decoded
AFTER EMIT ?decoded
AFTER DECODE ?hexenc AS hex SET ?hexdec
AFTER EMIT ?hexdec
(* Output: hellohello *)

COMPUTE

COMPUTE runs advanced mathematical functions. Single-argument functions use OF [n]. Two-argument functions use OF [n] AND [n].

Single-Argument Functions
COMPUTE fibonacci OF 20 SET ?fib
AFTER EMIT ?fib
AFTER COMPUTE factorial OF 5 SET ?fact
AFTER EMIT ?fact
AFTER COMPUTE prime OF 100 SET ?prime
AFTER EMIT ?prime
AFTER COMPUTE sqrt OF 16 SET ?root
AFTER EMIT ?root
AFTER COMPUTE abs OF -42 SET ?abs
AFTER EMIT ?abs
AFTER COMPUTE round OF 3.14159 SET ?rounded
AFTER EMIT ?rounded
AFTER COMPUTE floor OF 3.9 SET ?floor
AFTER EMIT ?floor
AFTER COMPUTE ceil OF 3.1 SET ?ceil
AFTER EMIT ?ceil
Two-Argument Functions
COMPUTE power OF 2 AND 8 SET ?pow
AFTER EMIT ?pow
AFTER COMPUTE mod OF 17 AND 5 SET ?mod
AFTER EMIT ?mod
COMPUTE vs CALCULATE — CALCULATE evaluates inline expressions (10 + 5 * 2). COMPUTE calls specific named mathematical functions with defined inputs. They are not interchangeable.
Cache & Remember/Recall →

RANDOMIZE INT, FLOAT and DATE AND TIME

Three range-bounded randomisers. Each takes FROM RANGE and TO, and each is inclusive of both ends.

Bounded Random Values
RANDOMIZE INT FROM RANGE 1 TO 6 SET ?die
AFTER RANDOMIZE FLOAT FROM RANGE 0 TO 1 SET ?weight
AFTER RANDOMIZE DATE AND TIME FROM RANGE "2026-01-01" TO "2026-12-31" SET ?when
AFTER EMIT ?die & " " & ?weight & " " & ?when