Are there any one-way hashing functions available in native JavaScript?

Question

I'd like to be able to create unique tokens* for users based on a hashed string. I know I could, for example, use a md5() library but as the purpose is not cryptographic I was wondering if there was anything I could use "out of the box." Are there any one-way hashing functions available in native JavaScript?

*I realize these won't be strictly unique. I'm ok with a small chance of hashing collision.

you may like this question - stackoverflow.com/questions/105034/… — Anurag
– Anurag, Commented Feb 24, 2011 at 22:55
Yup, like that a lot. I need a one way hash vs. GUIDs. I have a a large string and want to hash it into a smaller string the same way every time. md5 works for that purposes but seems like overkill. — buley
– buley, Commented Feb 24, 2011 at 23:08

Weihang Jian · Accepted Answer · 2020-08-20 07:13:26Z

24

In 2020, there is a native API:

SubtleCrypto.digest()

https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest

example:

crypto.subtle
  .digest("SHA-256", new TextEncoder().encode("hello"))
  .then(console.log);

hex string conversion:

const digest = async ({ algorithm = "SHA-256", message }) =>
  Array.prototype.map
    .call(
      new Uint8Array(
        await crypto.subtle.digest(algorithm, new TextEncoder().encode(message))
      ),
      (x) => ("0" + x.toString(16)).slice(-2)
    )
    .join("");

digest({message: "hello"}).then(console.log)

edited Aug 20, 2020 at 7:13

answered Aug 20, 2020 at 7:03

Weihang Jian

8,9456 gold badges53 silver badges60 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Drowsy Over a year ago

The SubtleCrypto API requires a TLS-enabled website, however. Are there any options that lack this constraint?

Darryl Noakes Over a year ago

Note: all browsers actually supported this by mid 2015 already; except Edge, which didn't have SHA-1 support until Jan 2020 with "New Edge" and the switch to Chromium. Node got support in 2020.

Mantriur Over a year ago

@Drowsy I'm wondering the same thing. This would be very useful to add at least some MITM mitigation for pages that can't use SSL, e.g. embedded systems working on an IP address.

Caerulius · Accepted Answer · 2016-10-11 04:23:05Z

12

JavaScript does not have native hashing, but there are many libraries.

I recommend crypto-js: https://code.google.com/p/crypto-js/

For example, to use SHA1, you simply:

<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/rollups/sha1.js"></script>
<script>
    var hash = CryptoJS.SHA1("Message");
</script>

edited Oct 11, 2016 at 4:23

Caerulius

4254 silver badges21 bronze badges

answered Nov 25, 2014 at 13:09

Tero Niemi

1,09712 silver badges13 bronze badges

Comments

Alex Ciminian · Accepted Answer · 2018-09-27 20:05:00Z

6

Nothing is available in native JavaScript. You could use something like Murmurhash. There's a JavaScript implementation here: https://github.com/garycourt/murmurhash-js. I haven't used it though so can't vouch for it.

Update: now there are multiple Murmurhash3 implementations available in JavaScript. However, many of them have problems encoding strings to bytes and can produce different results compared to the reference C++ implementation. You can read an analysis on this here, the murmurhash3js-revisited library implements all three variants of the function and conforms to the reference.

edited Sep 27, 2018 at 20:05

Alex Ciminian

11.5k16 gold badges64 silver badges95 bronze badges

answered Feb 25, 2011 at 1:29

Tim Down

326k76 gold badges461 silver badges546 bronze badges

Comments

Adam Grant · Accepted Answer · 2016-05-24 17:27:23Z

5

Over the horizon, this may be possible with the currently experimental Web Crypto API

https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API

https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto

Granted, at the time of this writing it is unrealistic to use in a production environment and will likely be a moving target. However, come 5 years who knows?

answered May 24, 2016 at 17:27

Adam Grant

13.2k10 gold badges61 silver badges65 bronze badges

1 Comment

Adam Grant Over a year ago

Personally, I'd really like to explore using this to share code between sites using localStorage (there's a hack allowing to use this cross domain). Crypto signing could protect against a site masking evil code as the saved version of jQuery, for example. CDN does this now, but requires an HTTP request.

Collectives™ on Stack Overflow

Are there any one-way hashing functions available in native JavaScript?

4 Answers 4

3 Comments

Comments

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

3 Comments

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related