What does the "bits" in hash functions mean?

I started studying hash functions but I still do not understand what the bits mean.

What does it mean to say that MD5 is 128-bits or that SHA-1 is 160 bits? How is this calculated?

  • $\begingroup$ If you like the answer, please accept it so that everyone else knows it's "resolved" :) $\endgroup$ – user47922 Jun 13 '17 at 3:20

That's referring to the size of the output, or message digest, of a hash function. MD5 outputs an 128-bit hash value. Or: there are $2^{128}$ possible outputs.

In Python:

>> md5("hello, world").hexdigest()

You can see 32 hexadecimal (hex) digits that represent 16 bytes or 128 bits. Here's that value in binary; there are 128 $0$s and $1$s, or binary digits that represent bits:


To calculate, just count them!

Likewise, for SHA-1, you have 160 bits, 20 bytes or 40 hex digits. There are $2^{160}$ possible outputs:

 >> sha1("hello, world").hexdigest()

The output size of a hash is directly linked to the maximum security level that can be achieved. The security level is half of the bits if the birthday problem applies for example if the hash is over a string as above. It's the full amount if this isn't the case.

Note that both MD5 and SHA-1 are considered broken for most usage scenarios, so the above calculations do not apply to them anymore. The amount of security offered is much less than the output size would suggest.

| improve this answer | |
  • 1
    $\begingroup$ Expanded your answer somewhat and I changed characters to digits, hope you approve. Otherwise edit or role back. $\endgroup$ – Maarten Bodewes Jun 11 '17 at 22:00

One hexadecimal digit is of one nibble (4 bits). Two nibbles make 8 bits which are also called 1 byte.

MD5 generates an output (128 bit) which is represented using a sequence of 32 hexadecimal digits, which in turn are 32*4=128 bits. 128 bits make 16 bytes (since 1 byte is 8 bits).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.