---
id: hashin
version: "1.0.5"
license: MIT
license_treatment: permissive
maintenance: active
---

# hashin — Edits your requirements.txt by hashing them in

License: permissive · Maintenance: active · Downloads: 142.9K/mo

## What it is and what it does

hashin is a command-line tool that automates the tedious process of generating SHA256 (or other algorithm) hashes for Python packages and writing them into your requirements.txt file in a format compatible with pip's --require-hashes flag. Instead of manually downloading each package, running pip hash on each file, and editing requirements.txt, you run hashin with a package name or version specifier and it handles all those steps.

The tool downloads packages from PyPI over HTTPS, computes their hashes, and updates your requirements file with the hash-locked entries. It supports filtering by Python version (useful when a package has wheels for multiple Python versions), dry-run mode to preview changes, environment markers, and can be used both as a CLI tool and as a Python library. The underlying philosophy is that you vet the downloaded packages yourself (using the --verbose flag to inspect download locations) before committing the hashes, then deploy those hash-locked requirements to servers with confidence that the exact same packages will be installed.

Use it for:

- Lock exact package versions and hashes in a development environment, then deploy those same hashes to production servers for reproducible installs.
- Add a new dependency to your requirements.txt with verified hashes without manually downloading and hashing each distribution file.
- Filter package hashes by Python version when a package offers wheels for multiple Python versions you don't all support.
- Preview changes to requirements.txt before committing them using --dry-run mode.
- Integrate hash-locked requirements into a deployment workflow where pip install --require-hashes enforces that only pre-vetted packages are installed.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Automates the process of adding cryptographic hashes to your requirements.txt file, enabling reproducible and verified package installations with pip's hash-checking mode.

Yes. hashin solves a real operational problem—automating hash generation for reproducible, verified package installations—with low install friction, active maintenance, no security vulnerabilities, and a permissive license. It is most valuable in deployment workflows where you want to enforce that production servers install only the exact packages you have vetted, but it requires discipline: you must manually inspect the downloaded files (via --verbose) to ensure they haven't been tampered with before committing the hashes.

## Install

pip install hashin
uv add hashin
poetry add hashin

## Installing hashin

Before you install: Low friction: pure Python wheel with only packaging and pip as runtime dependencies. Active maintenance with recent releases; last commit 2026-08-03 and latest release 2025-06-12 indicate ongoing support.

License in practice: MIT license (permissive) imposes no restrictions on use, modification, or distribution in your own projects.

Quickstart:

pip install hashin

hashin Django

# Or with specific version and output file:
hashin "requests==2.19.1" --requirements-file=requirements.txt

Requires Python 3.9 or later; downloads packages from PyPI over HTTPS during operation.

Verify before relying:

- Whether the tool's hash verification workflow integrates with CI/CD systems or requires manual vetting steps beyond what the description shows.
- Performance characteristics when processing large numbers of packages or requirements files.
- Compatibility with private PyPI repositories or alternative package indexes.

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 142.9K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

requirements.txt hash generator, pip hash automation, reproducible python dependencies, requirements file security, package integrity verification, pip install --require-hashes, dependency hash management, dependency-management, reproducible-builds, security-hardening

[View on SkillFed](https://skillfed.io/packages/hashin) · [View on PyPI](https://pypi.org/project/hashin/)