{"id":11480,"library":"object-hash","title":"Object Hash Generator","description":"object-hash is a JavaScript library designed to generate consistent hashes from various JavaScript objects and primitive values in both Node.js and browser environments. It leverages Node.js's built-in `crypto` module for hashing algorithms like SHA1 (default), MD5, and others available via `crypto.getHashes()`, as well as supporting custom stream processing. The current stable version is 3.0.0. A key aspect of its API contract, established since version 1.1.8 (April 2017), is that any changes affecting the exact returned hash value are considered `semver-major`, ensuring predictability for users. It differentiates itself by offering extensive configuration options, including the ability to ignore values, sort arrays/objects/sets for order-independent hashing, and respect or ignore function properties, making it highly flexible for use cases like caching, deduplication, or content addressing where object state needs to be consistently fingerprinted. It is important to note that default algorithms like SHA-1 and MD5 are not considered cryptographically secure and should not be used for security-sensitive applications.","status":"active","version":"3.0.0","language":"javascript","source_language":"en","source_url":"https://github.com/puleos/object-hash","tags":["javascript","object","hash","sha1","md5"],"install":[{"cmd":"npm install object-hash","lang":"bash","label":"npm"},{"cmd":"yarn add object-hash","lang":"bash","label":"yarn"},{"cmd":"pnpm add object-hash","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"The primary export is a default function. While modern bundlers often handle `import { hash } from 'object-hash'` due to interop, the canonical ESM import for a CJS default export is `import hash from 'object-hash;'` or `import * as hash from 'object-hash'`.","wrong":"import { hash } from 'object-hash';","symbol":"hash","correct":"import hash from 'object-hash';"},{"note":"This is the standard CommonJS import pattern, as shown in the package's examples.","symbol":"hash","correct":"const hash = require('object-hash');"},{"note":"Sugar methods like `sha1`, `MD5`, `keys` are properties of the main default export, not named exports themselves. Access them via the imported `hash` object.","wrong":"import { sha1 } from 'object-hash';","symbol":"hash.sha1","correct":"const hash = require('object-hash');\nconst myHash = hash.sha1({ a: 1 });"}],"quickstart":{"code":"const hash = require('object-hash');\n\n// Basic hashing of an object\nconst objectHash = hash({ foo: 'bar', baz: [1, 2, { a: 3 }] });\nconsole.log('Object Hash:', objectHash); // Example: '37a3c3d5e21d5a7b6c7a9f8d9b6e2d1f0a8c4b2e'\n\n// Hashing with specific algorithm and encoding (e.g., SHA256)\nconst sha256Hash = hash({ data: 'sensitive info' }, { algorithm: 'sha256', encoding: 'base64' });\nconsole.log('SHA256 Hash (Base64):', sha256Hash);\n\n// Hashing an object, ignoring values (only keys contribute to hash)\nconst keysOnlyHash = hash({ name: 'Alice', age: 30 }, { excludeValues: true });\nconsole.log('Keys-only Hash:', keysOnlyHash);\n\n// Hashing with unordered objects and arrays for consistent results regardless of property/element order\nconst unorderedHash1 = hash({ x: 1, y: 2 }, { unorderedObjects: true, unorderedArrays: true });\nconst unorderedHash2 = hash({ y: 2, x: 1 }, { unorderedObjects: true, unorderedArrays: true });\nconsole.log('Unordered Object Hash 1:', unorderedHash1);\nconsole.log('Unordered Object Hash 2:', unorderedHash2);\nconsole.log('Unordered hashes match:', unorderedHash1 === unorderedHash2);\n","lang":"javascript","description":"Demonstrates basic object hashing, specifying a different algorithm and encoding, hashing only object keys, and ensuring order-independent hashing for objects and arrays."},"warnings":[{"fix":"For applications relying on consistent hash outputs across minor versions, ensure you are using `object-hash@^1.1.8` or newer and strictly adhere to semver for major version updates.","message":"Prior to version 1.1.8 (released April 2017), changes to the exact hash output were not considered semver-major, meaning minor or patch updates could alter hash values. Since 1.1.8, any change affecting hash values is a breaking change and will be reflected in a major version bump.","severity":"breaking","affected_versions":"<1.1.8"},{"fix":"For security-sensitive applications, explicitly specify a stronger algorithm like `sha256` or `sha512` using the `algorithm` option (e.g., `{ algorithm: 'sha256' }`).","message":"The default hashing algorithm, SHA-1, and the readily available MD5 algorithm are not considered cryptographically secure for modern applications. They are vulnerable to collision attacks and should not be used for security-sensitive purposes like password hashing or digital signatures.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Understand the broad impact of `unorderedArrays`. If you only need order-independent hashing for specific types, consider using `unorderedSets` or `unorderedObjects` selectively, or implement a custom `replacer` function for fine-grained control.","message":"The `unorderedArrays` option, when set to `true`, affects the sorting of *all* iterable collections, including plain JavaScript arrays, `Set` instances, `Map` instances, and typed arrays. This might lead to unexpected behavior if users only anticipate it for basic arrays.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"When using `object-hash` in a browser environment, ensure your build process (e.g., Webpack, Rollup with appropriate plugins) provides a compatible polyfill for Node.js's `crypto` module, or use a library specifically designed for browser crypto APIs like `window.crypto.subtle`.","message":"In browser environments, `object-hash` relies on the Node.js `crypto` module. If not properly polyfilled or bundled for the browser, this can lead to runtime errors.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"When comparing hashes with other systems, be aware that `object-hash` employs a specific internal serialization strategy. If interoperability is required, either both systems must use `object-hash`, or the hashing logic of `object-hash` (which involves type-prefixing) must be replicated. This behavior is not explicitly documented and may require inspecting the source code for precise replication.","message":"Hash values generated by `object-hash` may differ from simple `JSON.stringify()` followed by a standard hashing algorithm (e.g., `crypto.createHash`). This is because `object-hash` prefixes values with their types and handles various JavaScript primitives and objects (e.g., functions, dates) differently.","severity":"gotcha","affected_versions":">=1.0.0"}],"env_vars":null,"last_verified":"2026-04-19T00:00:00.000Z","next_check":"2026-07-18T00:00:00.000Z","problems":[{"fix":"If bundling for the browser, configure your bundler (e.g., Webpack, Rollup) to polyfill the Node.js `crypto` module or use a browser-specific hashing library. Some bundlers automatically polyfill, but explicit configuration might be needed.","cause":"This error typically occurs in browser environments where Node.js's built-in `crypto` module is not available or properly polyfilled.","error":"TypeError: crypto.createHash is not a function"},{"fix":"Run `npm install object-hash` or `yarn add object-hash` in your project directory. Ensure your module resolution paths are correctly configured if working in a monorepo or custom environment.","cause":"The package `object-hash` is not installed or not resolvable in the current environment.","error":"Error: Cannot find module 'object-hash'"},{"fix":"Change your import statement to `import hash from 'object-hash';` for ESM, or use `import * as hash from 'object-hash';` for TypeScript/ESM interop with CommonJS modules.","cause":"`object-hash` provides a default export function, not a named export `hash`.","error":"TypeError: hash is not a function (when using ESM 'import { hash } from ...')"}],"ecosystem":"npm"}