
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
Fast and consistent hashCode for any object type
// ES2015
import hash from 'hash-it';
// CommonJS
const hash = require('hash-it');
// hash any standard object
console.log(hash({ foo: 'bar' })); // 13729774857125
// or a circular object
console.log(hash(window)); // 3270731309314
hash-it has a simple goal: provide a fast, consistent, unique hashCode for any object type that is uniquely based on its values. This has a number of uses such as duplication prevention, equality comparisons, blockchain construction, etc.
Any object type?
Yes, any object type. Primitives, ES2015 classes like Symbol, DOM elements (yes, you can even hash the window object if you want). Any object type. Here is the list of object classes that produce consistent, unique hashes based on their value:
ArgumentsArrayArrayBufferAsyncFunction (based on toString)AsyncGeneratorFunction (based on toString)BigIntBigInt64ArrayBigUint64ArrayBooleanDataView (based on its buffer)Date (based on getTime)DocumentFragment (based on outerHTML of all children)Error (based on stack)
TypeError, ReferenceError, etc.)Event (based on all properties other than Event.timeStamp)
MouseEvent, KeyboardEvent, etc.)Float32ArrayFloat64ArrayFunction (based on toString)GeneratorFunction (based on toString)Int8ArrayInt16ArrayInt32ArrayHTMLElement (based on outerHTML)
HTMLAnchorElement, HTMLDivElement, etc.)Map (order-agnostic)NullNumberObject (handles circular objects, order-agnostic)ProxyRegExpSet (order-agnostic)SharedArrayBufferStringSVGElement (based on outerHTML)
SVGRectElement, SVGPolygonElement, etc.)Symbol (based on toString)Uint8ArrayUint8ClampedArrayUint16ArrayUint32ArrayUndefinedWindowAre there any exceptions?
Sadly, yes, there are a few scenarios where internal values cannot be introspected for the object. In this case, the object is hashed based on its class type and reference.
Promise
Generator (the result of calling a GeneratorFunction)
Promise, there is no way to obtain the values contained within due to its dynamic iterable natureWeakMap / WeakRef / WeakSet
const promise = Promise.resolve(123);
console.log(hash(promise)); // 16843037491939
console.log(hash(promise)); // 16843037491939
console.log(hash(Promise.resolve(123))); // 4622327363876
If there is an object class or data type that is missing, please submit an issue.
While the hashes will be consistent when calculated within the same environment, there is no guarantee that the resulting hash will be the same across different environments due to environment-specific or browser-specific implementations of features. This is limited to extreme edge cases, such as hashing the window object, but should be considered if being used with persistence over different environments.
Clone the repo and dependencies via yarn. The npm scripts available:
benchmark => run benchmark of various data typesbenchmark:compare => run benchmark of some data types comparing against other hashing modulesbuild => run rollup to build ESM, CJS, and UMD filesclean => remove files produced from build scriptdev => run webpack dev server to run example app / playgroundlint => run ESLint against all files in the src folderlint:fix => run lint script, automatically applying fixable changesprepublishOnly => run typecheck, lint, test, and buildstart => alias for dev scripttest => run jest test functions with NODE_ENV=testtest:coverage => run test with coverage checkertest:watch => run test with persistent watchertypecheck => run tsc to validate internal typings6.0.0
Breaking changes
is / is.any / is.all / is.not) are no longer providedError type hashes now include the message (previously only included stack)Generator, Promise, WeakMap, WeakSet) now hash uniquely based on referenceWeakMap is now required at runtime (used as cache for circular references)Enhancements
new Number('123'))AsyncFunctionAsyncGeneratorFunctionBigInt64ArrayBigUint64ArrayGeneratorFunctionSharedArrayBufferWeakRef (same limitations as those for WeakMap / WeakSet)The object-hash package provides similar functionality to hash-it by generating unique hash values for JavaScript objects. It supports a variety of hashing algorithms and can handle complex nested structures. Compared to hash-it, object-hash offers more customization options for the hashing process.
The hasha package is a versatile hashing utility that supports multiple hashing algorithms like MD5, SHA-1, and SHA-256. While it is not specifically designed for hashing objects, it can be used to hash strings, buffers, and other data types. It is more general-purpose compared to hash-it.
The built-in Node.js crypto module provides a wide range of cryptographic functionalities, including hashing. While it is more complex and requires more setup to hash objects compared to hash-it, it offers extensive options for cryptographic operations and is highly customizable.
FAQs
Hash any object based on its value
The npm package hash-it receives a total of 326,709 weekly downloads. As such, hash-it popularity was classified as popular.
We found that hash-it demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.