Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is something I never understood about hashing functions. I know that algorithms like whirlpool and blowfish both produce outputs that don't follow this pattern, but why is it that most do? Is it some kind of hardware/software thing? If they did produce outputs that went a-z0-9 instead of a-f0-9, wouldn't that increase their complexity?

share|improve this question
Hash functions output a string of bits. The way you display them textually doesn't change their nature, only their encoding. – Thomas Oct 7 '12 at 0:51
up vote 16 down vote accepted

It's just hex encoded. A 16 byte md5 hash can contain non-printable characters, so it's encoded to a 32 char hex string.

share|improve this answer
This is correct. MD5 is 128-bit (16 bytes). It's encoded in hexadecimal so the resulting string is easier to work with and debug. The actual hash is always in binary, but in most programming languages and libraries, the default output from a hash function is an ascii/utf8 string of hexadecimal encoded binary string. – Matrix Oct 6 '12 at 22:27
I would add one could use base64 encoding and end up with printable characters (this is more common in encryption embedded in text mediums, like pgp in emails, or otr over xmpp) – ewanm89 Oct 6 '12 at 23:28
You can use any encoding you like - raw bytes, hex, base64, base10 32-bit little-endian DWORDs, etc. – Polynomial Oct 7 '12 at 0:11
@Polynomial yeah, I was just pointing out that bae64 is also a common encoding to get printable characters and is used quite commonly in security, at the end of the day, you could write it out as a string of 1s and 0s.... – ewanm89 Oct 7 '12 at 0:41

As others have responded, hash functions (all of them, including MD5, SHA-256, Whirlpool and the dozens of other functions) output bits. The output of MD5 is 128 bits. However, humans are bad at reading bits. Humans are good at reading characters. So, when a hash function output is meant for human consumption, it is converted to characters with some encoding.

Hexadecimal is one of the simplest encoding of bits into characters. It converts a chunk of four bits into a digit or a character in the 'a' to 'f' range. Other encodings exist, e.g. Base64, which uses a bigger alphabet (64 signs instead of 16) and is more compact (the 128-bit output of MD5 is encoded as 24 characters in Base64, vs 32 in hexadecimal), but is a bit more complex to implement.

There are many possible variants with hexadecimal; e.g. we can add some spaces every few characters (to ease reading), or other punctuation such as colon signs (':'); we can use uppercase or lowercase letters. Tradition for hash function outputs is to use lowercase with no space or punctuation. This tradition was already in force in the infancy of MD5: MD5 has been designed in 1991, published in April 1992 as RFC 1321; as you can see in that document (near the end, section A.5), hash outputs already use lowercase hexadecimal.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.