How to Hash a File in Node.js

What file hashing does and why you need it

A hash is a fixed-length string of characters that represents the contents of a file. When you hash a file, Node.js runs the file's data through a mathematical function that always produces the same output for the same input — but even changing one character in the file produces a completely different hash. This makes hashing useful for three real problems: verifying a file hasn't been corrupted during download, checking whether two files are identical without comparing them byte-by-byte, and storing passwords securely (though that uses different algorithms than file hashing).

Node.js includes the crypto module, which is built into the runtime and requires no installation. You use it to hash files with algorithms like MD5, SHA-1, SHA-256, and SHA-512. SHA-256 is the current standard for most purposes — MD5 and SHA-1 are cryptographically broken and should not be used for security-critical work, though they're fine for simple integrity checks.

Key Takeaways

Node.js's built-in crypto module handles file hashing without any package installation.
SHA-256 is the standard algorithm for file hashing; avoid MD5 and SHA-1 for anything security-related.
The crypto.createHash() method creates a hash object, and you pipe file data into it using fs.createReadStream().
Always use the 'hex' encoding when calling digest() so the hash is human-readable.
For large files, streaming the data prevents loading the entire file into memory at once.

The basic pattern: creating and using a hash object

To hash a file, you create a hash object with crypto.createHash(), feed the file data into it, and then call digest() to get the final hash. Here's the simplest working example:

const crypto = require('crypto');const fs = require('fs');const hash = crypto.createHash('sha256');const file = fs.readFileSync('myfile.txt');hash.update(file);const digest = hash.digest('hex');console.log(digest);

This reads the entire file into memory with readFileSync(), passes it to the hash object's update() method, and then calls digest('hex') to get the hash as a hexadecimal string. For small files this works fine, but for anything larger than a few megabytes, you should stream the data instead to avoid memory problems.

Streaming large files to avoid memory overload

When you hash a large file, reading it all at once wastes RAM. Instead, use fs.createReadStream() to read the file in chunks and feed each chunk to the hash object as it arrives:

The stream emits 'data' events as it reads chunks, and you update the hash with each chunk. When the stream finishes, the 'end' event fires and you call digest(). The 'error' event catches problems like a missing file or permission denied. This approach works for files of any size without memory issues.

Wrapping the streaming pattern in a reusable function

Rather than repeating the stream code every time, wrap it in a function that returns a Promise:

This function accepts a file path and an optional algorithm name (defaulting to SHA-256), and returns a Promise that resolves with the hash. You can now call it with await in an async function, making the code cleaner and easier to test.

Comparing file hashes to verify integrity

The most common reason to hash a file is to check whether it's been corrupted or modified. If you download a file and the provider publishes its hash, you can hash your downloaded copy and compare the two:

const downloadedHash = await hashFile('downloaded-file.zip');const publishedHash = 'a1b2c3d4e5f6...';if (downloadedHash === publishedHash) { console.log('File is intact.');} else { console.log('File has been corrupted or modified.');}

If the hashes match, the file is identical to the original. If they don't match, either the download was corrupted, the file was modified, or you're comparing against the wrong hash. This is why software vendors publish hashes alongside downloads — it lets users verify they got what was actually released.

Choosing the right algorithm for your use case

Node.js supports multiple hashing algorithms. SHA-256 is the safe default for almost everything. MD5 and SHA-1 are fast but cryptographically broken — they're fine for non-security purposes like deduplication or simple checksums, but never use them to verify file authenticity or detect tampering. SHA-512 is stronger than SHA-256 but slower and rarely necessary for file integrity checks.

You can list all available algorithms on your system by running crypto.getHashes(), which returns an array of supported algorithm names. If you're not sure which to pick, use SHA-256. It's fast enough for most files, produces a 64-character hex string, and is the current standard across the industry.

Frequently Asked Questions

Why does the same file produce the same hash every time?

Hash functions are deterministic — they always produce the same output for the same input. The algorithm processes the file's bytes in a fixed way, so identical files always hash to identical values. This is what makes hashing useful for verification.

What's the difference between update() and digest()?

update() feeds data into the hash object and processes it. digest() finalizes the hash and returns the result as a string. You can call update() multiple times with different chunks, but once you call digest(), the hash object is consumed and you can't use it again.

Can I hash a file without loading it into memory?

Yes — that's exactly what streaming does. fs.createReadStream() reads the file in small chunks (typically 64KB by default) and you update the hash with each chunk. The entire file never sits in memory at once, so you can hash files larger than your available RAM.

Is MD5 safe for file hashing?

MD5 is cryptographically broken and should not be used to verify file authenticity or detect intentional tampering. It's acceptable for simple checksums or deduplication where you're only checking for accidental corruption, but use SHA-256 instead if you have any doubt.

How do I hash multiple files at once?

Use Promise.all() to hash several files in parallel: Promise.all([hashFile('file1.txt'), hashFile('file2.txt'), hashFile('file3.txt')]).then(hashes => console.log(hashes)). This starts all three reads at the same time rather than waiting for each one to finish.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.