What does the "bits" in hash functions mean?

I started studying hash functions but I still do not understand what the bits mean.

What does it mean to say that MD5 is 128-bits or that SHA-1 is 160 bits? How is this calculated?

  • $\begingroup$ If you like the answer, please accept it so that everyone else knows it's "resolved" :) $\endgroup$
    – user47922
    Jun 13, 2017 at 3:20

2 Answers 2


That's referring to the size of the output, or message digest, of a hash function. MD5 outputs an 128-bit hash value. Or: there are $2^{128}$ possible outputs.

In Python:

>> md5("hello, world").hexdigest()

You can see 32 hexadecimal (hex) digits that represent 16 bytes or 128 bits. Here's that value in binary; there are 128 $0$s and $1$s, or binary digits that represent bits:


To calculate, just count them!

Likewise, for SHA-1, you have 160 bits, 20 bytes or 40 hex digits. There are $2^{160}$ possible outputs:

 >> sha1("hello, world").hexdigest()

The output size of a hash is directly linked to the maximum security level that can be achieved. The security level is half of the bits if the birthday problem applies for example if the hash is over a string as above. It's the full amount if this isn't the case.

Note that both MD5 and SHA-1 are considered broken for most usage scenarios, so the above calculations do not apply to them anymore. The amount of security offered is much less than the output size would suggest.

  • 1
    $\begingroup$ Expanded your answer somewhat and I changed characters to digits, hope you approve. Otherwise edit or role back. $\endgroup$
    – Maarten Bodewes
    Jun 11, 2017 at 22:00

One hexadecimal digit is of one nibble (4 bits). Two nibbles make 8 bits which are also called 1 byte.

MD5 generates an output (128 bit) which is represented using a sequence of 32 hexadecimal digits, which in turn are 32*4=128 bits. 128 bits make 16 bytes (since 1 byte is 8 bits).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.