For example, if the entropy of a password is 30 bits, what is the entropy of the password when you hash it with MD5?


1 Answer 1


Still 30 bits.

A hash function does not add entropy. It could change the entropy rate though. For example if you had 30 bits of entropy in a 64 bit password and hashed it to a 128 bit digest, the rate has gone down ($\frac{30}{64}\approx 0.47$, but $\frac{30}{128}\approx 0.23$). On the other hand, if the password is 500 bits, the entropy rate goes up.

One way to see this would be to look at all the possible values that the password could be. That would be $2^{30}$ since any other character (or bits) are assumed to be known to the attacker (otherwise they would add entropy, right?). Those $2^{30}$ values would be fed into the hash function and result in $2^{30}$ different digests. So there are the same number of passwords as digests. No added entropy.

  • 4
    $\begingroup$ Actually, because of the possibility of collisions, the hashing might slightly reducing the entropy. $\endgroup$ Oct 12, 2012 at 19:45
  • $\begingroup$ @PaŭloEbermann, good point. Hard to quantify though, right? $\endgroup$
    – mikeazo
    Oct 13, 2012 at 1:32
  • 7
    $\begingroup$ @mikeazo You can calculate that using the number of output states(2^128) and the poisson distribution. The effect is negligible unless the input entropy approaches the output size. $\endgroup$ Oct 13, 2012 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.