6 ms·

Show HN: Calculate MD5, SHA-1 in your browser using HTML5 and WebWorkers

19 points by chadkeck 15y ago

tptacek 15y ago
Why would I want this? By this I mean, what's an end-to-end use case for it? In which a user wants a SHA hash of a file, uses this thing to get it, and then does something with the hash.
- chadkeck 15y ago
  Hey Thomas, The itch I was scratching with this tool is that there isn't a built-in way in Windows to get a digest of a file, so... what better way than doing it in the browser? Also, I'm the paranoid type and don't like the idea of uploading a file to someone else's server if I want the digest.
  - thirsteh 15y ago
    This could be useful to validate large files after downloading them, e.g. ISO files for Linux distributions--however that goes out the window with the 10MB size limit. Why the limit? Does it take too long to compute hashes for larger files?
    - chadkeck 15y ago
      Absolutely agreed. It is due to the immaturity of the browser implementations, which will hopefully be fixed soon. It regularly crashes(!) Chrome on "large" files; thus, the limitation.
      - antimatter15 15y ago
        You could split up the file chunks by reading in sections (blob.webkitSlice and mozSlice) as array buffers and sending them to a worker object. Then you could process those in chunks with WebWorkers (or WebGL) and have a progress indicator.
  - tptacek 15y ago
    You aren't worried that doing this via Javascript will make it insecure for that use? In almost the same manner as uploading your file to a server (simply to get the hash) would be?
    - chadkeck 15y ago
      I dont' really understand what you're saying here. Other services that calculate the digest of a file online require you to upload your file to the service/site where you don't know what they will do with it. With Browser Hash, not one bit of your file leaves your computer or travels over the network.
      - tptacek 15y ago
        How do I know that my file is never leaving my computer? To verify that, I have to verify every line of Javascript code influencing that page, every time I use it, to make sure it isn't spiriting away my file contents or feeding bogus SHA fingerprint values back to me.
      - xtacy 15y ago
        I think he means that the JavaScript that computes the hash can be MITM'd.
        wccrawford 15y ago
        How would it be MITM'd? It all happens on your computer. Nothing travels over the network after the page is downloaded.
        antimatter15 15y ago
        I think what xtacy means by MITM is that the javascript sent by the server might be MITM'd and altered to return a different value than the actual hash. But for instance, if I'm trying to SHA1 a Windows 8 iso (the kind which I imagine would be by far the most common use case - in which a cryptographically secure hash algorithm isn't even a prerequisite any checksum would do). It's not any worse than downloading the sha1sum app from any http site.
  - Zash 15y ago
    In this world where everything is done through a browser, where would I drop my files from? On a serious note, can one drop an attachment from say gmail onto that? And dear someone, please tell me that sha1sum & friends exists for Windows!
    - chadkeck 15y ago
      1. Haha, I agree that files will eventually become less accesible for the majority of computer users. Something like how the iPad handles projects/songs/documents instead of the generic "file". 2. Due to HTML5 limitations, you will need to drop the file from your local storage onto the browser window. 3. Yes you can get digests of a file on Windows, but it doesn't come with a built-in program.
      - antimatter15 15y ago
        There's a certain cool factor of file drag/drop but I think that the click-to-browse paradigm is useful on certain laptop trackpads where dragging isn't a pleasure and other situations. It would be nice if you made the drag area clickable (like min.us).
- re 15y ago
  Browser-based upload, but with file-hash-based deduping to skip the upload if possible, à la Dropbox? (Not a use-case for this site, but one for in-browser file hashing)
ericb 15y ago
What is the license? I haven't looked too closely yet, but I might want to borrow some of the JS for a firefox plugin where I'd want to calculate hashes.
- antimatter15 15y ago
  It looks like it just uses the js crypto libs from http://pajhome.org.uk/crypt/md5/ http://pajhome.org.uk/crypt/md5/
- chadkeck 15y ago
  The code is up on github. I will add the MIT license soon (do what you want with the code). The hash functions came from Paj here: http://pajhome.org.uk/crypt/md5/ http://pajhome.org.uk/crypt/md5/ IIRC, Firefox's add-on API already has an MD5 calculation method.
Zash 15y ago
From the blog post: > * Internet connection required (for now). There's this thing called caching. ;) Also, cache manifest.
- chadkeck 15y ago
  Yeah, the cache manifest will be the next feature for Browser Hash :)
HardyLeung 15y ago
Try http://www.hashsum.com http://www.hashsum.com It's a Silverlight application I wrote years ago (as a warmup) and it does MD5, SHA1, SHA256, etc. and it is much faster than any Javascript or Flash implementation I've ever seen, including this one. Apology for the very poor Google adsense placement and UI. Yeah it is embarrassing. It was my first introduction to web programming, Google Adsense, and UI, and I've moved on from it long ago. Needless to say I have learned a lot since then. Hashsum can handle much bigger files than 10MB. In fact, for a file that small, you won't even notice that it did anything. Try something bigger, like a DVD-sized ISO (4.7GB) which will take about 1 or 2 minutes. All computation is done on the client side. Anyone who claims Javascript is "as fast as C/C++" should at least try to beat Hashsum, which is only C# based. Sadly, Microsoft is putting an end to this amazing technology, but that's another story.

19 points by chadkeck 15y ago

Why would I want this? By this I mean, what's an end-to-end use case for it? In which a user wants a SHA hash of a file, uses this thing to get it, and then does something with the hash.

chadkeck 15y ago
Hey Thomas, The itch I was scratching with this tool is that there isn't a built-in way in Windows to get a digest of a file, so... what better way than doing it in the browser? Also, I'm the paranoid type and don't like the idea of uploading a file to someone else's server if I want the digest.
- thirsteh 15y ago
  This could be useful to validate large files after downloading them, e.g. ISO files for Linux distributions--however that goes out the window with the 10MB size limit. Why the limit? Does it take too long to compute hashes for larger files?
  - chadkeck 15y ago
    Absolutely agreed. It is due to the immaturity of the browser implementations, which will hopefully be fixed soon. It regularly crashes(!) Chrome on "large" files; thus, the limitation.
    - antimatter15 15y ago
      You could split up the file chunks by reading in sections (blob.webkitSlice and mozSlice) as array buffers and sending them to a worker object. Then you could process those in chunks with WebWorkers (or WebGL) and have a progress indicator.
- tptacek 15y ago
  You aren't worried that doing this via Javascript will make it insecure for that use? In almost the same manner as uploading your file to a server (simply to get the hash) would be?
  - chadkeck 15y ago
    I dont' really understand what you're saying here. Other services that calculate the digest of a file online require you to upload your file to the service/site where you don't know what they will do with it. With Browser Hash, not one bit of your file leaves your computer or travels over the network.
    - tptacek 15y ago
      How do I know that my file is never leaving my computer? To verify that, I have to verify every line of Javascript code influencing that page, every time I use it, to make sure it isn't spiriting away my file contents or feeding bogus SHA fingerprint values back to me.
    - xtacy 15y ago
      I think he means that the JavaScript that computes the hash can be MITM'd.
      - wccrawford 15y ago
        How would it be MITM'd? It all happens on your computer. Nothing travels over the network after the page is downloaded.
        antimatter15 15y ago
        I think what xtacy means by MITM is that the javascript sent by the server might be MITM'd and altered to return a different value than the actual hash. But for instance, if I'm trying to SHA1 a Windows 8 iso (the kind which I imagine would be by far the most common use case - in which a cryptographically secure hash algorithm isn't even a prerequisite any checksum would do). It's not any worse than downloading the sha1sum app from any http site.
- Zash 15y ago
  In this world where everything is done through a browser, where would I drop my files from? On a serious note, can one drop an attachment from say gmail onto that? And dear someone, please tell me that sha1sum & friends exists for Windows!
  - chadkeck 15y ago
    1. Haha, I agree that files will eventually become less accesible for the majority of computer users. Something like how the iPad handles projects/songs/documents instead of the generic "file". 2. Due to HTML5 limitations, you will need to drop the file from your local storage onto the browser window. 3. Yes you can get digests of a file on Windows, but it doesn't come with a built-in program.
    - antimatter15 15y ago
      There's a certain cool factor of file drag/drop but I think that the click-to-browse paradigm is useful on certain laptop trackpads where dragging isn't a pleasure and other situations. It would be nice if you made the drag area clickable (like min.us).
re 15y ago
Browser-based upload, but with file-hash-based deduping to skip the upload if possible, à la Dropbox? (Not a use-case for this site, but one for in-browser file hashing)

ericb 15y ago

What is the license? I haven't looked too closely yet, but I might want to borrow some of the JS for a firefox plugin where I'd want to calculate hashes.

antimatter15 15y ago
It looks like it just uses the js crypto libs from http://pajhome.org.uk/crypt/md5/ http://pajhome.org.uk/crypt/md5/
chadkeck 15y ago
The code is up on github. I will add the MIT license soon (do what you want with the code). The hash functions came from Paj here: http://pajhome.org.uk/crypt/md5/ http://pajhome.org.uk/crypt/md5/ IIRC, Firefox's add-on API already has an MD5 calculation method.

Zash 15y ago

From the blog post: > * Internet connection required (for now). There's this thing called caching. ;) Also, cache manifest.

chadkeck 15y ago
Yeah, the cache manifest will be the next feature for Browser Hash :)

HardyLeung 15y ago

Try http://www.hashsum.com http://www.hashsum.com It's a Silverlight application I wrote years ago (as a warmup) and it does MD5, SHA1, SHA256, etc. and it is much faster than any Javascript or Flash implementation I've ever seen, including this one. Apology for the very poor Google adsense placement and UI. Yeah it is embarrassing. It was my first introduction to web programming, Google Adsense, and UI, and I've moved on from it long ago. Needless to say I have learned a lot since then. Hashsum can handle much bigger files than 10MB. In fact, for a file that small, you won't even notice that it did anything. Try something bigger, like a DVD-sized ISO (4.7GB) which will take about 1 or 2 minutes. All computation is done on the client side. Anyone who claims Javascript is "as fast as C/C++" should at least try to beat Hashsum, which is only C# based. Sadly, Microsoft is putting an end to this amazing technology, but that's another story.