Cách Băm (Hash) File Trong JavaScript: SHA-256, MD5 và SHA-1

Calculating cryptographic hashes of files is fundamental for data deduplication, tamper verification, and integrity checks. Modern browsers provide the high-performance Web Crypto API for SHA-256 and SHA-512, while Node.js offers the native crypto module with streaming support.

Tính Mã Băm Với Web Crypto API Trên Trình Duyệt

The Web Crypto API runs inside the browser engine using hardware-accelerated cryptographic primitives:

export async function calculateFileSha256(file: File): Promise<string> {
  const arrayBuffer = await file.arrayBuffer();
  const hashBuffer = await crypto.subtle.digest('SHA-256', arrayBuffer);

  // Convert ArrayBuffer to Hex string
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  const hexHash = hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');

  return hexHash;
}

Truyền Luồng Tính Hash Trong Node.js (Tệp Lớn)

When hashing multi-gigabyte files in Node.js, loading the entire file into memory with fs.readFileSync causes out-of-memory crashes. Use streaming transforms instead:

import fs from 'fs';
import crypto from 'crypto';

export function getFileChecksum(filePath: string, algorithm = 'sha256'): Promise<string> {
  return new Promise((resolve, reject) => {
    const hash = crypto.createHash(algorithm);
    const stream = fs.createReadStream(filePath);

    stream.on('data', (chunk) => hash.update(chunk));
    stream.on('end', () => resolve(hash.digest('hex')));
    stream.on('error', (err) => reject(err));
  });
}

Khi Nào Nên Dùng MD5 vs SHA-256

• MD5: Cryptographically broken. Do not use for password hashing, digital signatures, or security checks. Still widely used for non-security checksums, such as AWS S3 ETag verification and local file caching keys.
• SHA-256: Strong cryptographic collision resistance. The industry benchmark for software releases, package integrity, and blockchain transactions.