# Which Hash Algorithms Does Croc Support and When to Use Each One

> Discover the hash algorithms supported by Croc: MD5, XXHash, IMOHash, and HighwayHash. Learn when to use each for optimal speed, security, and collision resistance.

- Repository: [Zack/croc](https://github.com/schollz/croc)
- Tags: deep-dive
- Published: 2026-07-23

---

**Croc supports four hash algorithms—MD5, XXHash, IMOHash, and HighwayHash—each selected via the `HashFile` function in [`src/utils/utils.go`](https://github.com/schollz/croc/blob/main/src/utils/utils.go) to balance speed, cryptographic security, and collision resistance.**

Croc, the secure file transfer tool developed by schollz, implements multiple hashing strategies to verify file integrity during transfers. Understanding which hash algorithms croc supports and when to use them ensures you configure the appropriate security level without sacrificing unnecessary performance.

## Supported Hash Algorithms

The core hashing utilities live in **[`src/utils/utils.go`](https://github.com/schollz/croc/blob/main/src/utils/utils.go)**. The `HashFile` helper dispatches to specific implementations based on the algorithm string argument:

```go
switch algorithm {
case "imohash":
    return IMOHashFile(fname)
case "md5":
    return MD5HashFile(fname, doShowProgress)
case "xxhash":
    return XXHashFile(fname, doShowProgress)
case "highway":
    return HighwayHashFile(fname, doShowProgress)
}

```

According to the croc source code, the repository supports four distinct algorithms with varying characteristics:

### MD5 (Message Digest 5)

**MD5** provides a 128-bit hash that is widely supported but cryptographically broken. Implementation resides in `MD5HashFile` within [`src/utils/utils.go`](https://github.com/schollz/croc/blob/main/src/utils/utils.go).

Use **MD5** only for legacy compatibility or quick integrity checks where security is irrelevant—such as verifying a file wasn't corrupted during a local copy. Do not use MD5 for any security-sensitive operations.

### XXHash (Extremely Fast Hash)

**XXHash** is a non-cryptographic hash algorithm producing approximately 8 bytes of output. The `XXHashFile` function implements this via the `github.com/cespare/xxhash/v2` dependency declared in `go.mod`.

Choose **XXHash** when you need maximum throughput for large files and do not require cryptographic guarantees. This is ideal for deduplication, cache validation, or progress-bar hashing where speed outweighs collision resistance.

### IMOHash

**IMOHash** uses a sampling-based approach that reads representative portions of files rather than the entire contents. Implemented in `IMOHashFile` and `IMOHashFileFull`, this algorithm balances computation speed with better collision resistance than pure non-cryptographic hashes.

Select **IMOHash** for large files where you require reasonable security assurance without the computational cost of full cryptographic hashing. This provides a middle ground between XXHash and HighwayHash.

### HighwayHash

**HighwayHash** is a 256-bit cryptographically secure hash optimized for modern CPU architectures. The implementation lives in `HighwayHashFile` and relies on `github.com/minio/highwayhash` per `go.mod`.

Use **HighwayHash** for security-critical contexts—such as generating room names from shared secrets or verifying file integrity over untrusted networks. This provides strong cryptographic guarantees while maintaining performance.

## Algorithm Selection Guide

When deciding which hash algorithm croc supports fits your use case, consider this hierarchy:

- **Security-critical transfers**: Use **HighwayHash**. It offers 256-bit cryptographic strength suitable for generating secure identifiers and verifying sensitive data.
- **Large files requiring balanced protection**: Use **IMOHash**. The sampling method provides adequate collision resistance for file verification without reading every byte.
- **Maximum performance, no security needs**: Use **XXHash**. This is the fastest option for internal consistency checks where accidental corruption—not malicious tampering—is the only concern.
- **Legacy systems only**: Use **MD5** solely for backward compatibility with existing checksums, never for security purposes.

## Implementation Examples

### Using the Generic Helper Function

The `HashFile` function in [`src/utils/utils.go`](https://github.com/schollz/croc/blob/main/src/utils/utils.go) provides a unified interface:

```go
// Cryptographically secure (recommended for transfers)
hash, err := utils.HashFile("sensitive-document.pdf", "highway")
if err != nil { log.Fatal(err) }
fmt.Printf("HighwayHash: %x\n", hash)

// Fast non-cryptographic (for progress indicators)
hash, err = utils.HashFile("large-archive.tar", "xxhash")
fmt.Printf("XXHash: %x\n", hash)

```

### Calling Specific Hash Functions Directly

For scenarios requiring explicit control, invoke the dedicated functions directly:

```go
// MD5 - fast but insecure (avoid for security)
md5hash, _ := utils.MD5HashFile("legacy-file.bin", false)
fmt.Printf("MD5: %x\n", md5hash)

// IMOHash - balanced approach for large files
imoHash, _ := utils.IMOHashFile("video-content.mkv")
fmt.Printf("IMOHash: %x\n", imoHash)

// HighwayHash - secure and performant
highwayHash, _ := utils.HighwayHashFile("confidential-data.zip", false)
fmt.Printf("HighwayHash: %x\n", highwayHash)

```

## Summary

- Croc supports **four hash algorithms**: MD5, XXHash, IMOHash, and HighwayHash, implemented in [`src/utils/utils.go`](https://github.com/schollz/croc/blob/main/src/utils/utils.go).
- **HighwayHash** provides cryptographic security (256-bit) optimized for modern CPUs, ideal for secure transfers.
- **IMOHash** offers a sampling-based approach balancing speed and collision resistance for large files.
- **XXHash** delivers maximum non-cryptographic speed for integrity checks where security is irrelevant.
- **MD5** remains available for legacy compatibility but should never be used for security-sensitive operations.
- The `HashFile` dispatcher selects implementations via a switch statement based on the algorithm string parameter.

## Frequently Asked Questions

### What is the fastest hash algorithm in croc?

**XXHash** is the fastest algorithm supported by croc, designed specifically for high-throughput scenarios like deduplication and progress monitoring. It outperforms cryptographic alternatives because it skips the computational overhead required for collision resistance, making it ideal for verifying file integrity in trusted environments.

### Is MD5 secure for file transfers in croc?

**No.** While [`src/utils/utils.go`](https://github.com/schollz/croc/blob/main/src/utils/utils.go) retains `MD5HashFile` for backward compatibility, MD5 is cryptographically broken and vulnerable to collision attacks. Use MD5 only for legacy checksum verification where you already have MD5 hashes, never for generating secure identifiers or protecting against tampering.

### When should I use IMOHash instead of HighwayHash?

Use **IMOHash** when transferring very large files where you need reasonable collision resistance but cannot afford the I/O cost of reading every byte for a full cryptographic hash. **HighwayHash** requires reading the entire file contents, while IMOHash samples representative sections, making it faster for multi-gigabyte transfers while maintaining better security than XXHash.

### Where are the hash implementations tested?

The test suite in **[`src/utils/utils_test.go`](https://github.com/schollz/croc/blob/main/src/utils/utils_test.go)** exercises each hash algorithm (MD5, XXHash, IMOHash, and HighwayHash) to verify correct output generation and error handling. These tests validate that the switch logic in `HashFile` correctly dispatches to the appropriate implementation and that each algorithm produces consistent, expected hash values.