How do you generate hashes for a Python requirements file?

To generate hashes, pin every package to an exact version, record a sha256 hash for each downloadable file, then tell pip to require hashes. pip can compute a hash for a local file, and a lock tool can write hashes for the whole tree. Every dependency must be covered, or pip errors.

What hash checking protects

pip's documentation says hash-checking mode uses hashes stored in a requirements file to protect against remote tampering and network issues. If an index, a mirror or a connection hands you a file that differs from the one you approved, the install fails instead of running it.

It does not tell you the file you approved was safe in the first place. You are recording what you reviewed, not proving it is clean.

The rules pip enforces

• Adding a hash to any one requirement turns hash checking on for the whole file.
• Hashes are required for all dependencies. A package missing from the file causes an error.
• Every requirement must be pinned to an exact version, a URL or a local path.
• sha256 is recommended. Algorithms such as md5 and sha1 are excluded.
• A package can list several hashes, which you need when it ships separate files for different platforms.

You can also force the mode with the environment variable PIP_REQUIRE_HASHES, which suits deploy scripts.

Three ways to get the hashes

1. Bootstrap with pip. Run the install in require hashes mode on a clean machine. pip prints the hash of each file it fetched. It only fetches the preferred file per package, so you may miss other platforms.
2. Compute one by hand. The command pip hash followed by a downloaded file path prints its hash line. Use this to check a specific file.
3. Let a lock tool write them. The uv documentation covers compiling a requirements file and states that runtime dependencies are checked with the require hashes option on install or sync. A tool that locks for all your target platforms avoids gaps.

Common failure and the fix

The usual surprise is a package that has a Linux file and a macOS file. You generate hashes on one, deploy on the other, and pip rejects the install. Either generate on every target platform, or use a lock tool that records all files for each version.

Try it yourself

Click through it at your own pace, or open it full screen. Look at how a pinned inventory lets new advisories be matched to what you run.

Quick check

Safeguard's dependency scanning watches pinned packages for newly published advisories. A free scan works on a requirements file.

Sources

• Secure installs, pip documentation
• pip install reference
• Locking and syncing environments, uv documentation

Last reviewed: 19 October 2026.