hashin

What it is and what it does

hashin is a command-line tool that automates the tedious process of generating SHA256 (or other algorithm) hashes for Python packages and writing them into your requirements.txt file in a format compatible with pip's --require-hashes flag. Instead of manually downloading each package, running pip hash on each file, and editing requirements.txt, you run hashin with a package name or version specifier and it handles all those steps.

The tool downloads packages from PyPI over HTTPS, computes their hashes, and updates your requirements file with the hash-locked entries. It supports filtering by Python version (useful when a package has wheels for multiple Python versions), dry-run mode to preview changes, environment markers, and can be used both as a CLI tool and as a Python library. The underlying philosophy is that you vet the downloaded packages yourself (using the --verbose flag to inspect download locations) before committing the hashes, then deploy those hash-locked requirements to servers with confidence that the exact same packages will be installed.

Use it for:

• Lock exact package versions and hashes in a development environment, then deploy those same hashes to production servers for reproducible installs.
• Add a new dependency to your requirements.txt with verified hashes without manually downloading and hashing each distribution file.
• Filter package hashes by Python version when a package offers wheels for multiple Python versions you don't all support.
• Preview changes to requirements.txt before committing them using --dry-run mode.
• Integrate hash-locked requirements into a deployment workflow where pip install --require-hashes enforces that only pre-vetted packages are installed.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Automates the process of adding cryptographic hashes to your requirements.txt file, enabling reproducible and verified package installations with pip's hash-checking mode.

Yes. hashin solves a real operational problem—automating hash generation for reproducible, verified package installations—with low install friction, active maintenance, no security vulnerabilities, and a permissive license. It is most valuable in deployment workflows where you want to enforce that production servers install only the exact packages you have vetted, but it requires discipline: you must manually inspect the downloaded files (via --verbose) to ensure they haven't been tampered with before committing the hashes.

Install

hashin on PyPI

pip install hashin

uv add hashin

poetry add hashin

Installing hashin

Before you install

Low friction: pure Python wheel with only packaging and pip as runtime dependencies. Active maintenance with recent releases; last commit 2026-08-03 and latest release 2025-06-12 indicate ongoing support.

License in practice

MIT license (permissive) imposes no restrictions on use, modification, or distribution in your own projects.

Quickstart

pip install hashin

hashin Django

# Or with specific version and output file:
hashin "requests==2.19.1" --requirements-file=requirements.txt

Requires Python 3.9 or later; downloads packages from PyPI over HTTPS during operation.

Verify before relying

• Whether the tool's hash verification workflow integrates with CI/CD systems or requires manual vetting steps beyond what the description shows.
• Performance characteristics when processing large numbers of packages or requirements files.
• Compatibility with private PyPI repositories or alternative package indexes.

Package facts

Evidence: hashin-1.0.5-py2.py3-none-any.whl

Keywords: pip, repeatable, deploy, deployment, hash, install, installer

Tags

More Build Tools packages