nix-hash(1)

💖 NAME 💖

nix-hash — compute the cryptographic hash of a path. that's it, that's the whole vibe. it's giving "cryptographic hash of a path" and honestly? iconic.

this one lives in the General Commands Manual, section 1, bestie. nix-hash(1), no cap. 🎀

---

✨ SYNOPSIS ✨

nix-hash [--flat] [--base32] [--truncate] [--type hashAlgo] path…

nix-hash [--to-base16|--to-base32|--to-base64|--to-sri] [--type
hashAlgo] hash…

two whole modes, two whole moods. first line = hashing things. second line = converting hashes between formats. pick your fighter. 💅

---

🌸 DESCRIPTION 🌸

okay so. the command nix-hash computes the cryptographic hash of the contents of each path and prints it on standard output. yes, each one. multiple paths = multiple hashes, we love a multitasker. 💖

by default it computes an MD5 hash, but bestie there are other hash algorithms available too, we're not stuck in the past. the hash is printed in hexadecimal unless you say otherwise.

not me about to drop the most important lore: to generate the same hash as nix-prefetch-url you have to specify multiple arguments — see the example below, iykyk. 👑

the hash is computed over a serialisation of each path: a dump of the file system tree rooted at the path. this is the way that directories and symlinks can be hashed as well as regular files, which is honestly kind of the whole point. ✨ the dump is in the Nix Archive (NAR) format produced by nix-store --dump.

thus, nix-hash path yields the same cryptographic hash as nix-store --dump path | md5sum. literally identical. no cap. 🫶

---

🦋 OPTIONS 🦋

• --flat — print the cryptographic hash of the contents of each regular file path. that is, instead of computing the hash of the Nix Archive (NAR) of path, just directly hash path as is. this requires path to resolve to a regular file rather than a directory (so… don't try it on a directory, she will absolutely refuse 💀). the result is identical to that produced by the GNU commands md5sum and sha1sum.
• --base16 — print the hash in a hexadecimal representation (default, so this is just you being explicit about it 💖).
• --base32 — print the hash in Nix32 representation rather than hexadecimal. this representation is more compact and can be used in Nix expressions (such as in calls to fetchurl). compact queen. 🎀
• --base64 — similar to --base32, but print the hash in a Base64 representation, which is more compact than the Nix32 one. the way she keeps shrinking… slay.
• --sri — print the hash in SRI format with Base64 encoding. the type of hash algorithm will be prepended to the hash string, followed by a hyphen (-) and the Base64 hash body.
• --truncate — truncate hashes longer than 160 bits (such as SHA-256) to 160 bits. yes, she's cutting the ends off. 💅
• --type hashAlgo — use the specified cryptographic hash algorithm, which can be one of blake3, md5, sha1, sha256, and sha512. those five, exactly those five, periodt.
• --to-base16 — don't hash anything (we're off duty ✋), but convert the Nix32 hash representation hash to hexadecimal.
• --to-base32 — don't hash anything, but convert the hexadecimal hash representation hash to Nix32.
• --to-base64 — don't hash anything, but convert the hexadecimal hash representation hash to Base64.
• --to-sri — don't hash anything, but convert the hexadecimal hash representation hash to SRI.

---

🌈 EXAMPLES 🌈

computing the same hash as nix-prefetch-url

bestie this is the one everyone gets wrong at first, so pay attention: you need --type sha256 --flat --base32 to match her exactly. lowkey gagged at how specific that is.

$ nix-prefetch-url file://<(echo test)
1lkgqb6fclns49861dwk9rzb6xnfkxbpws74mxnx01z9qyv1pjpj
$ nix-hash --type sha256 --flat --base32 <(echo test)
1lkgqb6fclns49861dwk9rzb6xnfkxbpws74mxnx01z9qyv1pjpj

same string, both lines. that's the whole point. 🤝

computing hashes

let's set up a little test folder and go through every format, because we're thorough around here.

$ mkdir test
$ echo "hello" > test/world

$ nix-hash test/ (MD5 hash; default)
8179d3caeff1869b5ba1744e5a245c04

$ nix-store --dump test/ | md5sum (for comparison)
8179d3caeff1869b5ba1744e5a245c04  -

$ nix-hash --type sha1 test/
e4fd8ba5f7bbeaea5ace89fe10255536cd60dab6

$ nix-hash --type sha1 --base16 test/
e4fd8ba5f7bbeaea5ace89fe10255536cd60dab6

$ nix-hash --type sha1 --base32 test/
nvd61k9nalji1zl9rrdfmsmvyyjqpzg4

$ nix-hash --type sha1 --base64 test/
5P2Lpfe76upazon+ECVVNs1g2rY=

$ nix-hash --type sha1 --sri test/
sha1-5P2Lpfe76upazon+ECVVNs1g2rY=

$ nix-hash --type sha256 --flat test/
error: reading file `test/': Is a directory

$ nix-hash --type sha256 --flat test/world
5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03

see that error: reading file \test/': Is a directory? that's the --flat` + directory situation. she said regular file only and she meant it. don't be surprised, bestie. 😭

converting between hexadecimal, Nix32, Base64, and SRI

no hashing here, just glow-ups in both directions. transforming between formats is so main character energy. ⭐

$ nix-hash --type sha1 --to-base32 e4fd8ba5f7bbeaea5ace89fe10255536cd60dab6
nvd61k9nalji1zl9rrdfmsmvyyjqpzg4

$ nix-hash --type sha1 --to-base16 nvd61k9nalji1zl9rrdfmsmvyyjqpzg4
e4fd8ba5f7bbeaea5ace89fe10255536cd60dab6

$ nix-hash --type sha1 --to-base64 e4fd8ba5f7bbeaea5ace89fe10255536cd60dab6
5P2Lpfe76upazon+ECVVNs1g2rY=

$ nix-hash --type sha1 --to-sri nvd61k9nalji1zl9rrdfmsmvyyjqpzg4
sha1-5P2Lpfe76upazon+ECVVNs1g2rY=

$ nix-hash --to-base16 sha1-5P2Lpfe76upazon+ECVVNs1g2rY=
e4fd8ba5f7bbeaea5ace89fe10255536cd60dab6

little detail for you: that last one has no --type at all, because SRI carries the algorithm in the string itself. she's self-sufficient. 🧚

---

and that's the whole page, bestie!! 🫶 you just read the entire General Commands Manual entry for nix-hash(1) (section 1, official manual vibes) — go forth and hash responsibly, mwah 💖🌸✨