diff --git a/convex/liveChat.ts b/convex/liveChat.ts
index fc4dae5..1468d96 100644
--- a/convex/liveChat.ts
+++ b/convex/liveChat.ts
@@ -10,8 +10,10 @@ import { bytesToHex as toHex } from "@noble/hashes/utils.js"
 // HELPERS
 // ============================================
 
+const utf8 = (s: string) => new TextEncoder().encode(s)
+
 function hashToken(token: string) {
-  return toHex(sha256(token))
+  return toHex(sha256(utf8(token)))
 }
 
 async function validateMachineToken(
diff --git a/convex/machines.ts b/convex/machines.ts
index a127fa3..737da17 100644
--- a/convex/machines.ts
+++ b/convex/machines.ts
@@ -92,6 +92,8 @@ function toHex(input: Uint8Array) {
     .join("")
 }
 
+const utf8 = (s: string) => new TextEncoder().encode(s)
+
 function computeFingerprint(tenantId: string, companySlug: string | undefined, hostname: string, ids: NormalizedIdentifiers) {
   const payload = JSON.stringify({
     tenantId,
@@ -100,7 +102,7 @@ function computeFingerprint(tenantId: string, companySlug: string | undefined, h
     macs: ids.macs,
     serials: ids.serials,
   })
-  return toHex(sha256(payload))
+  return toHex(sha256(utf8(payload)))
 }
 
 function generateManualFingerprint(tenantId: string, displayName: string) {
@@ -110,7 +112,7 @@ function generateManualFingerprint(tenantId: string, displayName: string) {
     nonce: toHex(randomBytes(16)),
     createdAt: Date.now(),
   })
-  return toHex(sha256(payload))
+  return toHex(sha256(utf8(payload)))
 }
 
 function formatDeviceCustomFieldDisplay(
@@ -180,7 +182,7 @@ function matchesExistingHardware(existing: Doc<"machines">, identifiers: Normali
 }
 
 function hashToken(token: string) {
-  return toHex(sha256(token))
+  return toHex(sha256(utf8(token)))
 }
 
 function getRemoteAccessTokenGraceMs() {
diff --git a/convex/usbPolicy.ts b/convex/usbPolicy.ts
index b7b0d07..4cb95b7 100644
--- a/convex/usbPolicy.ts
+++ b/convex/usbPolicy.ts
@@ -11,8 +11,10 @@ function toHex(input: Uint8Array) {
     .join("")
 }
 
+const utf8 = (s: string) => new TextEncoder().encode(s)
+
 function hashToken(token: string) {
-  return toHex(sha256(token))
+  return toHex(sha256(utf8(token)))
 }
 
 export const USB_POLICY_VALUES = ["ALLOW", "BLOCK_ALL", "READONLY"] as const