hashrat

No entries match these filters. Clear filters

1. docs update Sep 8, 2026 · issue 068

   Hashrat 1.23 documents full CLI surface: TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. generation, network hashing via SSH/HTTP, xattrxattrExtended attributes: key-value metadata pairs attached to filesystem objects beyond standard POSIX fields like permissions and timestamps, letting tools store arbitrary annotations directly on files without a separate database. storage, memcachedmemcachedA distributed, in-memory key-value cache daemon used to reduce database load by storing frequently accessed data in RAM, giving cyber tools fast, low-latency state sharing across multiple processes or hosts. integration, and duplicate detection

   └──▷ TRY IT
   Generate a TOTP code from an otpauth URL — useful for scripting MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. workflows or validating TOTP secrets without a phone app
   copy

   $ hashrat -totp 'otpauth://totp/Example:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example' -digits 6 -period 30

   Hash a file on a remote host over SSH using a key file, then store the result in the local file's extended attributes for fast future verification
   copy

   $ hashrat -sha256 -net -idfile ~/.ssh/id_ed25519 ssh://auditor:@fileserver:22/var/log/auth.log

   Baseline an entire directory tree into xattr hashes, then re-check and trigger an alert script on any file that has changed — good for host-based integrity monitoring
   copy

   $ hashrat -sha256 -r -xattr /etc && hashrat -sha256 -r -c -xattr -hook /usr/local/bin/alert-changed.sh /etc

   • Adds -totp <secret> and -totp <url> flags to generate TOTP codes from a shared secret or an otpauth: URL, with -digits <n> and -period <n> to control code length and lifetime
   • Adds -net flag to treat file arguments as ssh:// or http:// URLs, pulling and hashing remote files over the network; -idfile <path> supplies an SSH private key instead of a password
   • Adds -xattr and -txattr flags to store and verify hashes in extended file attributes (trusted/root-only attributes under -txattr), with -cache to skip re-hashing files whose xattr hash is still fresh
   • Adds -lm and -memcached <server> / -mcd <server> flags to upload hashes to a memcached server and use it as the hash-list source for -m, -c, and -cf modes
   • Adds -dups flag to search for duplicate files by hash

   +14 more show less

   • Adds -u <types> flag to update hash stores (comma-separated list: xattr, memcached, or a file name) as files are checked
   • Adds -C <dir> and -Cf <dir> flags for recursive directory checking against a hash list, capable of detecting new files not in the list
   • Adds -rename flag to rename files to include their hash in the filename, using the format <name>-<hash>.<extn>
   • Adds -hook <script> / -h <script> flag to run a script when a file fails check mode, is found in match mode, or a duplicate is found
   • Adds -xsel flag to update the X11 clipboard and primary selection with the current hash via Xterm command sequences
   • Adds -xdialog flag to run in GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. dialog mode using yad, zenity, or qarma, with -dialog-types to specify the preferred dialog command order
   • Adds -mtime <days>, -mmin <mins>, and -myear <years> flags (same semantics as find) to restrict hashing to files of a given age
   • Adds -name <pattern>, -i <pattern>, -x <pattern>, and -X <path> flags for fine-grained include/exclude filtering of hashed files
   • Adds -iprefix <prefix> and -oprefix <prefix> flags to prepend a string to all input before hashing or to the front of all output hashes
   • Adds -devmode flag to hash device nodes directly
   • Adds -dirmode / -dir flag to hash an entire directory tree as a single hash value
   • Supports chaining multiple hash algorithms via -type <algo1,algo2,...> (comma-separated list), piping output of each hash into the next
   • Supports symlink invocation names (md5sum, sha256sum, whirlpoolsum, jh256sum, etc.) so hashrat auto-selects the matching algorithm and traditional output format
   • Supports output encoding in octal (-8), decimal (-10), uppercase hex (-H), base32 (-32, -c32, -w32, -z32), base64 (-64, -i64, -p64, -x64, -u64, -g64), and ASCII85 (-a85, -z85)

   19 details in Everything

2. 1.21 Jun 20, 2024 · release notes

   Adds -list-hashes to enumerate supported algorithms and enables openssl-provided hash types in v1.21

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.21 https://github.com/ColumPaget/Hashrat.git
   # already have the repo? check out this version:
   $ git checkout 1.21

   • -hmac option now works correctly after libUseful updates.
   • Adds -list-hashes flag to list available hash types.
   • Adds -sha384 flag to compute SHA-384 digests.
   • Supports openssl-provided hashes, extending the algorithm surface beyond built-in types.

   4 details in Everything

3. 1.20 Jun 18, 2024 · release notes

   hashrat v1.20 adds configure flags for zlib/hardening and honors stdin hash type in match mode

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.20 https://github.com/ColumPaget/Hashrat.git
   # already have the repo? check out this version:
   $ git checkout 1.20

   └──▷ USE IT
   Build hashrat with zlib compression support and hardening flags enabled
   shell copy

   ./configure --enable-zlib --enable-harden
   make check

   Use hashrat to match hashes provided via stdin pipe without specifying type on CLI
   shell copy

   echo "e99a18c428cb38d5f260853678922e03" | hashrat -m match

   • Adds --enable-harden and --enable-zlib options to the ./configure script to control build-time capabilities
   • Enables hashrat's match (-m) command to honor the hash type supplied via stdin

   2 details in Everything

4. v1.10.3 Dec 6, 2019 · release notes

   v1.10.3 adds -v flag for per-file hash timing

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.10.3 https://github.com/ColumPaget/Hashrat.git
   # already have the repo? check out this version:
   $ git checkout v1.10.3

   └──▷ USE IT
   Inspect the time taken to hash individual files by appending -v to the standard command.
   shell copy

   hashrat -v /path/to/target

   • Adds -v CLI flag to enable verbose mode which prints per-file hash-time duration in standard output
   • Upgrades dependency to libUseful-4, resolving compilation failures on macOSx related to xsetattr

   2 details in Everything

5. v1.9 Sep 22, 2018 · release notes

   Adds -X flag for file exclusion lists, CGI mode configuration via options file, and experimental recursive HTTP URL scanning.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.9 https://github.com/ColumPaget/Hashrat.git
   # already have the repo? check out this version:
   $ git checkout v1.9

   └──▷ USE IT
   Scan a directory while ignoring large binary archives defined in a separate exclusion list.
   shell copy

   hashrat -X excludes.txt ./source_dir

   Recursively scan a website by following links found in HTML pages.
   shell copy

   hashrat -net -r http://example.com/index.html

   • Adds -X option to load an exclude list of files from a file
   • Enables configuring CGI mode defaults and output format via an options file
   • Adds experimental recursion for HTTP URLs by processing links within HTML files

   3 details in Everything

6. v.1.8.11 Oct 9, 2017 · release notes

   hashrat v1.8.11 adds hook script support for find duplicates mode

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v.1.8.11 https://github.com/ColumPaget/Hashrat.git
   # already have the repo? check out this version:
   $ git checkout v.1.8.11

   └──▷ HOW TO FIND IT
   Run duplicate detection while executing a custom hook script for each pair of found duplicates.
   📍hashrat find duplicates --hook-script ./my_hook.sh
7. 1.8.6 Jun 2, 2017 · release notes

   Hashrat 1.8.6 adds multiple pattern support for -i and -x, fixes stdin fallback behavior

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.8.6 https://github.com/ColumPaget/Hashrat.git
   # already have the repo? check out this version:
   $ git checkout 1.8.6

   └──▷ TRY IT
   Include and exclude multiple file types in a single command without chaining flags.
   copy

   $ hashrat -i "*.js,*.ts" -x "node_modules/,test/"

   • -i and -x flags now accept comma-separated lists of patterns instead of single values

   1 detail in Everything

8. v1.8.3 Sep 22, 2016 · release notes

   hashrat v1.8.3 adds -type for chaining multiple hash algorithms via CLI

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.8.3 https://github.com/ColumPaget/Hashrat.git
   # already have the repo? check out this version:
   $ git checkout v1.8.3

   └──▷ USE IT
   Chain sha256 then sha1 hashing on stdin output to a file.
   shell copy

   echo "data" | hashrat -type sha256,sha1

   └──▷ BREAKING ON UPGRADE

   • !Many operations now return exit codes where they previously did not, which may affect scripts relying on silent failures.
9. v1.8.1 May 14, 2016 · release notes

   Adds FreeBSD extended attributes support and X11 clipboard output for hashes piped via stdin

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.8.1 https://github.com/ColumPaget/Hashrat.git
   # already have the repo? check out this version:
   $ git checkout v1.8.1

   • Builds on FreeBSD with support for freebsd extended attributes when hashing files
   • Piped hashes are now copied to the X11 primary selection and clipboard via Xterm control sequences

   2 details in Everything

10. 1.8.0 Jan 4, 2016 · release notes

    Adds -C and -Cf flags to load hash lists from file for directory scanning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.8.0 https://github.com/ColumPaget/Hashrat.git
    # already have the repo? check out this version:
    $ git checkout 1.8.0

    └──▷ USE IT
    Detect new files in a directory by matching them against a known-bad hash list.
    shell copy

    hashrat -C ./known_bad_hashes.txt ./suspicious_directory/

    • Add support for the -C flag to load hashes from a file and scan a target directory against that list.
    • Add support for the -Cf flag as an alternative mode for loading hashes from a file.

    2 details in Everything