gqlhash

Interactive visualization of the decision-making machine behind gqlhash-proxy. Same Go hasher, compiled to WebAssembly.
No document leaves your browser.

Hash function

What the labels mean

resistant: These hash functions are currently collision-resistant and will not produce the same hash for two different documents.
broken: With these hash functions two different documents may produce the same hash. Don't use this for anything that matters!
checksum: These hash functions are slightly faster but they're checksums and not cryptographically secure. Collisions are easy to produce. They can be used to group documents, but should never be used for the allowlist.

The algorithm used to hash the document.

Output format

How the hash is written out.

Ignore

Variables

Inputs

Nothing

What to leave out of the hash. Inputs skips argument and default values, so only the variable names and types are hashed. Variables skips those too, both where they're defined and where they're used.

Files

rename the file
delete it
switch files

Reset playground

Checking…

Operations

What a client sends

Each file is one GraphQL document a client could send. The tab you're on is the one the banner above is about; the other tabs show what the allowlist makes of them.

The hash skips comments, line breaks, indentation and commas. A document that was reformatted or minified still matches the entry it was registered as.

Operation hash

Copy Copied

Allowlist

What the proxy allows

The directory -allowlist points at. One file is one entry: everything in it is hashed as a single document.

A request goes through if its hash matches an entry. Everything else gets 403 Forbidden. If two files have the same hash, both are dropped — the proxy can't tell which one was meant.

Entry hash

Copy Copied