<NME> index.rst
<BEF> .. rst-class:: hide-header

ItsDangerous
============

.. image:: _static/itsdangerous-logo.png
    :align: center
    :target: https://palletsprojects.com/p/itsdangerous/

Sometimes you want to send some data to untrusted environments, then get
it back later. To do this safely, the data must be signed to detect
changes.
but they can not modify the contents unless they also have your secret
key.  So if you keep the key secret and complex, you will be fine.

Internally itsdangerous uses HMAC and SHA1 for signing by default and bases the
implementation on the `Django signing module
<https://docs.djangoproject.com/en/dev/topics/signing/>`_.  It also
however supports JSON Web Signatures (JWS).  The library is BSD licensed and
be fine.


Installing
----------

Install and update using `pip`_:

.. code-block:: text

    pip install -U itsdangerous

.. _pip: https://pip.pypa.io/en/stable/quickstart/


Example Use Cases
-----------------

-   Sign a user ID in a URL and email it to them to unsubscribe from a
    newsletter. This way you don't need to generate one-time tokens and
    store them in the database. Same thing with any kind of activation
    link for accounts and similar things.
-   Signed objects can be stored in cookies or other untrusted sources
    which means you don't need to have sessions stored on the server,
    which reduces the number of necessary database queries.
-   Signed information can safely do a round trip between server and
    client in general which makes them useful for passing server-side
    state to a client and then back.


Table of Contents
-----------------
>>> s = Signer('secret-key')
>>> s.sign('my string')
'my string.wh6tMHxLgJqB6oY1uT73iMlyrOA'
    
The signature is appended to the string, separated by a dot (``.``).  To
validate the string, use the :meth:`~Signer.unsign` method:

    timed
    url_safe
    encoding
    license
    changes

<MSG> document SHA-512 default
closes #85

<DFF> @@ -13,7 +13,7 @@ Granted, the receiver can decode the contents and look into the package,
 but they can not modify the contents unless they also have your secret
 key.  So if you keep the key secret and complex, you will be fine.
 
-Internally itsdangerous uses HMAC and SHA1 for signing by default and bases the
+Internally itsdangerous uses HMAC and SHA-512 for signing by default and bases the
 implementation on the `Django signing module
 <https://docs.djangoproject.com/en/dev/topics/signing/>`_.  It also
 however supports JSON Web Signatures (JWS).  The library is BSD licensed and
@@ -52,7 +52,7 @@ can be used to attach a signature to a specific string:
 >>> s = Signer('secret-key')
 >>> s.sign('my string')
 'my string.wh6tMHxLgJqB6oY1uT73iMlyrOA'
-    
+
 The signature is appended to the string, separated by a dot (``.``).  To
 validate the string, use the :meth:`~Signer.unsign` method:
 

document SHA-512 default closes #85