Maintained fork of object-hash — generate hashes from any javascript value, in Node.js and the browser.
The original has ~320M downloads/month and no release since 2022. This fork keeps the same API and fixes what was broken underneath: repeated references, browser/node divergence, the prototype-graph walk that halved performance.
npm install @bybrave/object-hash2// CommonJS — drop-in
const hash = require("@bybrave/object-hash2");
// ESM
import hash from "@bybrave/object-hash2";
hash({ foo: "bar" }); // 'a02...'
hash({ foo: "bar" }, { algorithm: "md5" }); // '132...'
hash.keys({ foo: "bar" }); // keys onlySame options as the original: algorithm, encoding, excludeValues, excludeKeys, replacer, respectType, respectFunctionProperties, respectFunctionNames, unorderedArrays, unorderedSets, unorderedObjects, ignoreUnknown — see the original documentation.
| Change | Original issue |
|---|---|
Repeated (non-circular) references hash like copies: hash([a, a]) === hash([[1,2], [1,2]]). Real cycles are still detected |
#78 |
Identical hashes in Node.js and the browser, byte for byte — the browser build runs the same serializer with own md5/sha1/sha256 (fuzz-checked against node:crypto) |
#62 |
Browser bundle 4.5 KB gzipped instead of ~10 KB (no more crypto-browserify) |
#91 |
~2x faster with default options: the respectType prototype-graph walk replaced with a compact type marker |
perf reports |
respectType no longer reads __proto__/constructor/prototype of foreign objects — no more crashes on classes with throwing prototype getters (Mongo ObjectID & co) |
#49 |
Buffer, Uint8Array, Uint8ClampedArray, ArrayBuffer and DataView with the same bytes hash the same |
— |
DataView hashes by content (the original hashed every DataView to the same constant) |
— |
TypeScript definitions shipped with the package (compatible with @types/object-hash) |
— |
ESM entry (import hash from "@bybrave/object-hash2") + exports map |
— |
| Build: esbuild instead of gulp + browserify; CI on Node 18/20/22; zero runtime dependencies (as before) | — |
This is a major release and some hashes change. If you persist hashes (cache keys, deduplication), regenerate them on upgrade — the original did the same in its 2.x → 3.x major.
Unchanged (byte-identical to 3.0.0, pinned by tests):
- primitives, strings, dates, regexps, URLs, errors, symbols, bigints, numeric typed arrays — with any options;
-
everything hashed with
respectType: false, as long as the value has no repeated references and no binary types listed below.
Changed:
- default-options hashes of values containing objects or functions (
respectType: trueused to serialize the whole prototype graph — that walk is now a compact marker); - values with repeated references (that's the #78 fix);
-
Buffer/Uint8Array/Uint8ClampedArray/ArrayBuffer/DataViewvalues (unified byte serialization, identical across platforms); - hashes produced in the browser (they now match Node.js — that's the point).
- API is unchanged — drop-in replacement for
object-hash:hash(),hash.sha1(),hash.keys(),hash.MD5(),hash.keysMD5(),hash.writeToStream(). - Node.js ≥ 18; modern browsers. Browser algorithms:
md5,sha1,sha256(+passthrough); in Node.js everything fromcrypto.getHashes(). - Browser
<script>builds:dist/object_hash.jsanddist/object_hash.min.js(globalobjectHash), shipped in the npm package.
If this package saves you time, you can support maintenance:
Bitcoin (BTC): bc1q37557q5jpeaxqydzwvf3jgj7zhnfpn2td3q40q
MIT, same as the original — see LICENSE. Based on object-hash by Scott Puleo and contributors.
