`hash`

Hashes (fingerprints) of text and files: MD5, SHA-1, SHA-256 and SHA-512, HMAC signatures, and a safe way to compare secrets. Hashes come back as lowercase hex text, the way VirusTotal and threat reports show them.

import hash

Example

import hash

say(hash.sha256("hello"))
say(hash.md5("hello"))
say(hash.hmac_sha256("secret", "message"))
say(hash.compare(hash.sha256("a"), hash.sha256("a")))

Functions

md5(text)

returns text

The MD5 hash of the text (UTF-8), as 32 hex characters. MD5 is broken for security, but threat feeds still use it to name files.

sha1(text)

returns text

The SHA-1 hash of the text (UTF-8), as 40 hex characters.

sha256(text)

returns text

The SHA-256 hash of the text (UTF-8), as 64 hex characters. This is the one to use today.

sha512(text)

returns text

The SHA-512 hash of the text (UTF-8), as 128 hex characters.

file_md5(path)

returns text

The MD5 hash of a file's bytes. Works on big files too (read a piece at a time).

file_sha1(path)

returns text

The SHA-1 hash of a file's bytes.

file_sha256(path)

returns text

The SHA-256 hash of a file's bytes: search for it on VirusTotal to see if the file is known malware.

file_sha512(path)

returns text

The SHA-512 hash of a file's bytes.

file(path)

returns map

Every common hash of a file in one read: {"md5", "sha1", "sha256", "size"}.

hmac_sha256(key, text)

returns text

A signature of text made with a secret key (HMAC-SHA256), as hex. Webhooks use this to prove a message really came from the sender.

compare(a, b)

returns bool

True if two texts are the same, checked in constant time, so an attacker can't learn a secret by timing the answer. Use it for passwords, tokens and signatures.