Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

I was about to use an online MD5 checksum calculator when I realized that my result could be added to a database. This is significant because the string I was going to type in was my bank password. Could online hash calculators be dangerous?

share|improve this question
8  
Semi-related: don't rely on the trick of unplugging the network cable, using the form, and closing the window, because plugins might run in the background, and local storage might be used to transmit next time you visit the site. (and clearing cookies, html5 history, flash objects won't always work, because you forgot one thing, browser history, and there's more) – George Bailey Jun 21 '12 at 17:02
1  
I know it's not really relevant to the question, but why on earth do you need a hash of your bank password? – user606723 Jun 21 '12 at 19:34
I was looking to see if my bank was salting the hashes of their account passwords on its server. I could only verify this using mine. – Gabriel Fair Jun 21 '12 at 20:29
If I have correctly understood your question, how much does it matter your hash is stored in a database? I can create many hashes online and use them somewhere else. How do those sites know where to use your hash to gain your account access? – mojo Jun 22 '12 at 10:01
1  
@GabrielFair - And how would you be getting the hash - have you hacked your back? (If so, salts are often stored with the password hashes). In general, I wouldn't expect a bank to provide extracts of hashes to anybody, as a security measure. If your bank has been hacked, and want to check against the 'released' list, change your password regardless, then compare the hashes. – Clockwork-Muse Jun 22 '12 at 22:22
show 2 more comments

3 Answers

up vote 4 down vote accepted

Yes, submitting your password to any website is dangerous.

There's nothing special about online hash calculators, think of it as no different from typing it in to Google or posting it on StackExchange. Not only could that website be storing the entered password but if you aren't connected over HTTPS then anyone could sniff that password.

If you want to calculated the MD5 of your password (though I'm not quite clear why you would?) do it locally - there's plenty of software a Google away to help you.

share|improve this answer
3  
One might want to have an MD5 or SHA1 hash of their password to check leaked hash lists and see if theirs is on it. The recent LinkedIn hack is a good example. – Iszi Jun 21 '12 at 18:12
Good point! Had not thought of that – Andy Smith Jun 22 '12 at 11:15
1  
Publishing the MD5/SHA1 hash of your password is almost as bad an idea as publishing the password itself. – CodesInChaos Jun 23 '12 at 13:31
up vote 7 down vote

Potentially yes, the hash could indeed be stored in a database for malicious use.

Never input your password into a third party website unless you trust the provider of the service AND the service is using some sort of authentiation/encryption scheme(SSL, HTTPS).

You could easily generate your own hashes on your own system, using MD5 libraries of various programming languages.

share|improve this answer
up vote 5 down vote

Of course anything can be considered dangerous - you certainly should not be putting any sensitive information into a system when you are not sure what's being done with it. Also a lot of these online calculators don't use https so your password would be sent in the clear anyway, so thats bad before getting started with what they are doing with it.

If you are wanting to calculate hashes you can do this locally on most operating systems particularly with something as simple as MD5, where there is support for it in almost all programming / scripting languages. So it would be best to do it locally unless the hash you're wanting to calculate is not sensitive anyway.

For example you could calculate it locally using python in 2 lines

import hashlib
print hashlib.md5("whatever your string is").hexdigest()
share|improve this answer
6  
Or PHP: php -r 'echo(md5("secret")."\n");' or bash: echo -n secret | md5sum or perl: perl -e 'use Digest::MD5 qw(md5 md5_hex md5_base64); print(md5_hex("secret")."\n");' – Ladadadada Jun 21 '12 at 16:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.