
Product
Microsoft Teams Notifications Are Now Available in Socket
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.
Simple object hashing, serialization and comparison utils.
[!NOTE] ohash v2 is the current release. For the previous API, see the v1 branch and the v2.0.1 release notes for migration.
Install ohash:
# ✨ Auto-detect (npm, yarn, pnpm, bun or deno)
npx nypm i ohash
Import:
// ESM import
import { hash, serialize, digest, isEqual } from "ohash";
import { diff } from "ohash/utils";
// Dynamic import
const { hash, serialize, digest, isEqual } = await import("ohash");
const { diff } = await import("ohash/utils");
import { hash, serialize, digest, isEqual } from "https://esm.sh/ohash";
import { diff } from "https://esm.sh/ohash/utils";
// Dynamic import
const { hash, serialize, digest, isEqual } = await import(
"https://esm.sh/ohash"
);
const { diff } = await import("https://esm.sh/ohash/utils");
hash(input)Hashes any JS value into a string.
The input is first serialized then it is hashed.
import { hash } from "ohash";
// "g82Nh7Lh3CURFX9zCBhc5xgU0K7L0V1qkoHyRsKNqA4"
console.log(hash({ foo: "bar" }));
serialize(input)Serializes any input value into a string for hashing.
[!IMPORTANT]
serializemethod uses best efforts to generate stable serialized values; however, it is not designed for security purposes. Keep in mind that there is always a chance of intentional collisions caused by user input.
import { serialize } from "ohash";
// "{foo:'bar'}"
console.log(serialize({ foo: "bar" }));
digest(str)Hashes a string using the SHA-256 algorithm and encodes it in Base64URL format.
import { digest } from "ohash";
// "f4OxZX_x_FO5LcGBSKHWXfwtSx-j1ncoSt3SABJtkGk"
console.log(digest("Hello World!"));
isEqual(obj1, obj2)Compare two objects using === and then fallbacks to compare based on their serialized values.
import { isEqual } from "ohash";
// true
console.log(isEqual({ a: 1, b: 2 }, { b: 2, a: 1 }));
diff(obj1, obj2)Compare two objects with nested serialization. Returns an array of changes.
The returned value is an array of diff entries with $key, $hash, $value, and $props. When logging, a string version of the changelog is displayed.
import { diff } from "ohash/utils";
const createObject = () => ({
foo: "bar",
nested: {
y: 123,
bar: {
baz: "123",
},
},
});
const obj1 = createObject();
const obj2 = createObject();
obj2.nested.x = 123;
delete obj2.nested.y;
obj2.nested.bar.baz = 123;
const changes = diff(obj1, obj2);
// Removed `nested.y`
// Changed `nested.bar.baz` from `"123"` to `123`
// Added `nested.x`
console.log(changes.join("\n"));
corepack enablepnpm installpnpm devMade with 💛 Published under MIT License.
Object serialization originally based on puleos/object-hash by Scott Puleo.
sha256 implementation originally based on brix/crypto-js.
| v1 | v2 |
|---|---|
objectHash(value) (stable digest string like object:1:string:3:foo:...) | serialize(value) for a stable string, or hash(value) for a SHA-256 hash |
hash(value) | Still hash(value) (implementation changed; output format differs) |
There is no v2 helper that reproduces the exact v1 objectHash string format. Use serialize when you need a stable structural string, and hash when you need a short digest.
Lodash is a comprehensive utility library that offers similar functionalities to ohash, such as deep cloning and merging objects. Lodash is more extensive and widely used in the industry, providing a broader range of functions and better performance optimizations.
Deepmerge is a package specifically designed for merging objects deeply. While ohash provides this functionality, deepmerge offers more advanced options for controlling the merge process, such as array concatenation and custom merge functions.
FAQs
Simple object hashing, serialization and comparison utils.
The npm package ohash receives a total of 28,653,975 weekly downloads. As such, ohash popularity was classified as popular.
We found that ohash demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.

Security News
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.