diff --git a/README.rst b/README.rst
index 7cddf5e..45e29eb 100644
--- a/README.rst
+++ b/README.rst
@@ -254,6 +254,10 @@ Version History
 
 next
 
+  * Order of hashes should not affect if a package in the requirements file
+    should be replaced or not.
+    See https://github.com/peterbe/hashin/issues/93
+
   * (Internal) All tests have been rewritten as plain pytest functions.
 
   * In Python 3, if the package can't be found you get a more explicit exception
diff --git a/hashin.py b/hashin.py
index 3ed9677..bbec469 100755
--- a/hashin.py
+++ b/hashin.py
@@ -230,10 +230,26 @@ def run_packages(
 
 
 def amend_requirements_content(requirements, all_new_lines):
-
     # I wish we had types!
     assert isinstance(all_new_lines, list), type(all_new_lines)
 
+    padding = " " * 4
+
+    def is_different_lines(package, new_lines):
+        # This assumes that for sure the package is already mentioned in the old
+        # requirements. Now we just need to double-check that they really are
+        # different.
+        # The 'new_lines` is what we might intend to replace it with.
+        lines = set()
+        for line in requirements.splitlines():
+            if regex.search(line):
+                lines.add(line.strip(" \\"))
+            elif lines and line.startswith(padding):
+                lines.add(line.strip(" \\"))
+            elif lines:
+                break
+        return lines != set([x.strip(" \\") for x in new_lines.splitlines()])
+
     for package, new_lines in all_new_lines:
         regex = re.compile(
             r"(^|\n|\n\r){0}==|(^|\n|\n\r){0}\[.*\]==".format(re.escape(package)),
@@ -245,10 +261,9 @@ def amend_requirements_content(requirements, all_new_lines):
             if requirements:
                 requirements = requirements.strip() + "\n"
             requirements += new_lines.strip() + "\n"
-        else:
+        elif is_different_lines(package, new_lines):
             # need to replace the existing
             lines = []
-            padding = " " * 4
             for line in requirements.splitlines():
                 if regex.search(line):
                     lines.append(line)
@@ -509,11 +524,8 @@ def get_package_hashes(
         else:
             raise PackageError("No releases could be found for {0}".format(version))
 
-    # Sorting them helps make sure the results are more predictable
-    # when running more than once for the same version
-    hashes = sorted(
-        get_releases_hashes(releases=releases, algorithm=algorithm, verbose=verbose),
-        key=lambda x: x["hash"],
+    hashes = list(
+        get_releases_hashes(releases=releases, algorithm=algorithm, verbose=verbose)
     )
     return {"package": package, "version": version, "hashes": hashes}
 

Order of hashes shouldn't matter
Consider this example:
```bash
▶ python hashin.py -r ~/songsearch/requirements.txt --dry-run --update-all
--- Old
+++ New
...
 xmltodict==0.11.0 \
-    --hash=sha256:add07d92089ff611badec526912747cf87afd4f9447af6661aca074eeaf32615 \
-    --hash=sha256:8f8d7d40aa28d83f4109a7e8aa86e67a4df202d9538be40c0cb1d70da527b0df
+    --hash=sha256:8f8d7d40aa28d83f4109a7e8aa86e67a4df202d9538be40c0cb1d70da527b0df \
+    --hash=sha256:add07d92089ff611badec526912747cf87afd4f9447af6661aca074eeaf32615
```

Nothing has actually changed but for some reason, the order of the hashes is different this time. That would cause an unnecessary change. 
diff --git a/tests/test_cli.py b/tests/test_cli.py
index f48b3de..3615e37 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -304,6 +304,55 @@ autocompeter==1.2.3
     assert result == new_lines[1]
 
 
+def test_amend_requirements_content_actually_not_replacement():
+    requirements = (
+        """
+autocompeter==1.2.2
+    --hash=sha256:33a5d0145e82326e781ddee1ad375f92cb84f8cfafea56e9504682adff64a5ee
+    --hash=sha256:4d64ed1b9e0e73095f5cfa87f0e97ddb4c840049e8efeb7e63b46118ba1d623a
+    """.strip()
+        + "\n"
+    )
+
+    new_lines = (
+        "autocompeter",
+        """
+autocompeter==1.2.2
+    --hash=sha256:4d64ed1b9e0e73095f5cfa87f0e97ddb4c840049e8efeb7e63b46118ba1d623a
+    --hash=sha256:33a5d0145e82326e781ddee1ad375f92cb84f8cfafea56e9504682adff64a5ee
+    """.strip()
+        + "\n",
+    )
+
+    result = hashin.amend_requirements_content(requirements, [new_lines])
+    # It should be unchanged because the only thing that changed was the
+    # order of the --hash lines.
+    assert result == requirements
+
+
+def test_amend_requirements_content_replacement_addition():
+    requirements = (
+        """
+autocompeter==1.2.2
+    --hash=sha256:33a5d0145e82326e781ddee1ad375f92cb84f8cfafea56e9504682adff64a5ee
+    """.strip()
+        + "\n"
+    )
+
+    new_lines = (
+        "autocompeter",
+        """
+autocompeter==1.2.2
+    --hash=sha256:4d64ed1b9e0e73095f5cfa87f0e97ddb4c840049e8efeb7e63b46118ba1d623a
+    --hash=sha256:33a5d0145e82326e781ddee1ad375f92cb84f8cfafea56e9504682adff64a5ee
+    """.strip()
+        + "\n",
+    )
+
+    result = hashin.amend_requirements_content(requirements, [new_lines])
+    assert result == new_lines[1]
+
+
 def test_amend_requirements_content_replacement_single_to_multi():
     """Change from autocompeter==1.2.2 to autocompeter==1.2.3
     when it was previously written as a single line and now
@@ -512,21 +561,21 @@ def test_run(murlopen, tmpfile, capsys):
         assert output.endswith("\n")
         lines = output.splitlines()
         assert lines[0] == "hashin==0.10 \\"
-        assert lines[1] == (
+        assert (
             "    --hash=sha512:0d63bf4c115154781846ecf573049324f06b021a1"
             "d4b92da4fae2bf491da2b83a13096b14d73e73cefad36855f4fa936bac4"
             "b2357dabf05a2b1e7329ff1e5455 \\"
-        )
-        assert lines[2] == (
+        ) in lines
+        assert (
             "    --hash=sha512:45d1c5d2237a3b4f78b4198709fb2ecf1f781c823"
             "4ce3d94356f2100a36739433952c6c13b2843952f608949e6baa9f95055"
             "a314487cd8fb3f9d76522d8edb50 \\"
-        )
-        assert lines[3] == (
+        ) in lines
+        assert (
             "    --hash=sha512:c32e6d9fb09dc36ab9222c4606a1f43a2dcc183a8"
             "c64bdd9199421ef779072c174fa044b155babb12860cf000e36bc4d3586"
             "94fa22420c997b1dd75b623d4daa"
-        )
+        ) in lines
 
 
 def test_run_atomic_not_write_with_error_on_last_package(murlopen, tmpfile):
@@ -1449,10 +1498,10 @@ def test_get_package_hashes_unknown_algorithm(murlopen, capsys):
         "version": "0.10",
         "hashes": [
             {
-                "hash": "0d63bf4c115154781846ecf573049324f06b021a1d4b92da4fae2bf491da2b83a13096b14d73e73cefad36855f4fa936bac4b2357dabf05a2b1e7329ff1e5455"
+                "hash": "45d1c5d2237a3b4f78b4198709fb2ecf1f781c8234ce3d94356f2100a36739433952c6c13b2843952f608949e6baa9f95055a314487cd8fb3f9d76522d8edb50"
             },
             {
-                "hash": "45d1c5d2237a3b4f78b4198709fb2ecf1f781c8234ce3d94356f2100a36739433952c6c13b2843952f608949e6baa9f95055a314487cd8fb3f9d76522d8edb50"
+                "hash": "0d63bf4c115154781846ecf573049324f06b021a1d4b92da4fae2bf491da2b83a13096b14d73e73cefad36855f4fa936bac4b2357dabf05a2b1e7329ff1e5455"
             },
             {
                 "hash": "c32e6d9fb09dc36ab9222c4606a1f43a2dcc183a8c64bdd9199421ef779072c174fa044b155babb12860cf000e36bc4d358694fa22420c997b1dd75b623d4daa"

pip install -e .[dev]
parse_log_pytest
pytest
pytest mock
3.6
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
attrs @ file:///opt/conda/conda-bld/attrs_1642510447205/work
certifi==2021.5.30
-e git+https://github.com/peterbe/hashin.git@fefd565a57d1b465f7112e6ac09181c2c9eb81ca#egg=hashin
importlib-metadata @ file:///tmp/build/80754af9/importlib-metadata_1631916693255/work
iniconfig @ file:///home/linux1/recipes/ci/iniconfig_1610983019677/work
mock==5.2.0
more-itertools @ file:///tmp/build/80754af9/more-itertools_1637733554872/work
packaging @ file:///tmp/build/80754af9/packaging_1637314298585/work
pip-api==0.0.26
pluggy @ file:///tmp/build/80754af9/pluggy_1615976315926/work
py @ file:///opt/conda/conda-bld/py_1644396412707/work
pyparsing @ file:///tmp/build/80754af9/pyparsing_1635766073266/work
pytest==6.2.4
toml @ file:///tmp/build/80754af9/toml_1616166611790/work
typing_extensions @ file:///opt/conda/conda-bld/typing_extensions_1647553014482/work
zipp @ file:///tmp/build/80754af9/zipp_1633618647012/work

name: hashin
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - attrs=21.4.0=pyhd3eb1b0_0
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2021.5.30=py36h06a4308_0
  - importlib-metadata=4.8.1=py36h06a4308_0
  - importlib_metadata=4.8.1=hd3eb1b0_0
  - iniconfig=1.1.1=pyhd3eb1b0_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.3=he6710b0_2
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - more-itertools=8.12.0=pyhd3eb1b0_0
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - packaging=21.3=pyhd3eb1b0_0
  - pip=21.2.2=py36h06a4308_0
  - pluggy=0.13.1=py36h06a4308_0
  - py=1.11.0=pyhd3eb1b0_0
  - pyparsing=3.0.4=pyhd3eb1b0_0
  - pytest=6.2.4=py36h06a4308_2
  - python=3.6.13=h12debd9_1
  - readline=8.2=h5eee18b_0
  - setuptools=58.0.4=py36h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - toml=0.10.2=pyhd3eb1b0_0
  - typing_extensions=4.1.1=pyh06a4308_0
  - wheel=0.37.1=pyhd3eb1b0_0
  - xz=5.6.4=h5eee18b_1
  - zipp=3.6.0=pyhd3eb1b0_0
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - mock==5.2.0
      - pip-api==0.0.26
prefix: /opt/conda/envs/hashin

tests/test_cli.py::test_amend_requirements_content_actually_not_replacement tests/test_cli.py::test_get_package_hashes_unknown_algorithm
tests/test_cli.py::test_get_latest_version_simple tests/test_cli.py::test_get_latest_version_only_pre_release tests/test_cli.py::test_get_latest_version_non_pre_release_leading_zeros tests/test_cli.py::test_get_hashes_error tests/test_cli.py::test_non_200_ok_download tests/test_cli.py::test_main_packageerrors_stderr tests/test_cli.py::test_packages_and_update_all tests/test_cli.py::test_no_packages_and_not_update_all tests/test_cli.py::test_main_version tests/test_cli.py::test_amend_requirements_content_new tests/test_cli.py::test_amend_requirements_content_multiple_merge tests/test_cli.py::test_amend_requirements_content_replacement tests/test_cli.py::test_amend_requirements_content_replacement_addition tests/test_cli.py::test_amend_requirements_content_replacement_single_to_multi tests/test_cli.py::test_amend_requirements_content_replacement_2 tests/test_cli.py::test_amend_requirements_content_replacement_amonst_others tests/test_cli.py::test_amend_requirements_content_replacement_amonst_others_2 tests/test_cli.py::test_amend_requirements_content_new_similar_name tests/test_cli.py::test_run tests/test_cli.py::test_run_atomic_not_write_with_error_on_last_package tests/test_cli.py::test_run_without_specific_version tests/test_cli.py::test_run_contained_names tests/test_cli.py::test_run_case_insensitive tests/test_cli.py::test_run_update_all tests/test_cli.py::test_run_dry tests/test_cli.py::test_run_dry_multiple_packages tests/test_cli.py::test_run_pep_0496 tests/test_cli.py::test_filter_releases tests/test_cli.py::test_release_url_metadata_python tests/test_cli.py::test_expand_python_version tests/test_cli.py::test_get_package_hashes tests/test_cli.py::test_get_package_hashes_package_not_found tests/test_cli.py::test_get_package_hashes_without_version tests/test_cli.py::test_with_extras_syntax tests/test_cli.py::test_extras_syntax_edit tests/test_cli.py::test_add_extra_extras_syntax_edit tests/test_cli.py::test_change_extra_extras_syntax_edit tests/test_cli.py::test_remove_extra_extras_syntax_edit
README.rst hashin.py
README.rst hashin.py