A file hash: what the hex length tells you

Files and text

A run of hex characters printed beside a file, where the number of characters is the only visible clue to what produced it.

The shape

A hash as you meet it on a page is a single unbroken run of hex. It has no prefix, no suffix, no internal punctuation and no fixed casing. Everything that identifies it sits outside the string: the algorithm name in a nearby label, the filename above it, the heading of the table it sits in. Remove that context and you are holding an anonymous run of hex.

Length: exactly 32, 40, 64 or 128 characters for the families you are likely to meet
Alphabet: hex only: 0 to 9 and a to f, described on the alphabets page
Case: lower case by convention, but hex is case insensitive, so AB and ab are the same two characters of digest
Separators: none. Spaces, colons or hyphens inside a digest were added by whoever printed it, for readability
Fixed part: there is none. Every character is variable, which is why length is the only structural rule
Padding: never trimmed. Leading zeros belong to the value and are always printed

the skeleton of a 64 character digest

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

sixty four x characters, each standing for one
character drawn from 0-9 or a-f, and nothing else

The skeleton for the other lengths is the same line, cut or extended to 32, 40 or 128 characters.

placeholders, counting up, one per length

32 characters
0123456789abcdef0123456789abcdef

40 characters
0123456789abcdef0123456789abcdef01234567

64 characters
0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

These are counting sequences, not digests of anything. A 128 character placeholder is the 64 character line above written twice, which will not fit on one line here.

What the length names

Hex writes four bits per character, so the character count is the digest size divided by four. That gives a small table which is worth knowing by heart, because it turns a count into a name.

Characters	Digest size	Algorithm family
32 characters	128 bits	MD5 and others of that size
40 characters	160 bits	SHA-1 and others of that size
64 characters	256 bits	SHA-256 and others of that size
128 characters	512 bits	SHA-512 and others of that size

Read the third column carefully. The length narrows the field; it does not identify the algorithm. Several algorithms produce a 256 bit digest, and several more can be asked to produce one at a chosen length. A 64 character hex string is consistent with a great many algorithms and inconsistent with only a few. If a page prints a digest without naming what produced it, the length does not fill the gap.

One further length appears occasionally: a digest printed at a size someone chose, such as 96 or 224 bits. Those are legitimate, and they are the reason the four rows above are described as the families you are likely to meet rather than the complete set.

How to check it by eye

Four seconds on a run of hex

Sweep the run once for any letter past f. A g, an o, a z or a stray l that is really a one all end the check on the spot.
Look for whitespace, colons and hyphens sitting inside the run rather than around it. A digest with internal punctuation has been reformatted by hand or by a display.
Count the run in groups of eight, working left to right. Counting by eye sets out a way to do this without losing your place on a long line.
Match the count against 32, 40, 64 and 128. A count that lands between two of those is the interesting result, and it usually means the string is short rather than exotic.
Read whatever label sits next to the string. If nothing names the algorithm or the file, note that the string arrived without either.

What a wrong shape means

Right shape

0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
64 characters, hex throughout

Wrong shape

0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcde
63 characters; the last one is gone

One character short. A field that clipped its input, a selection that stopped early and a paste that lost a trailing character all produce exactly this, and the string cannot say which of them happened.

Short is the common failure, and it is nearly always transport. Digests are long, they sit at the end of table cells, and selecting one by dragging is easy to get wrong by a character at either end. A digest that is one or two characters short of a standard length has usually been damaged between the page that published it and the place you are reading it.

A run containing a character outside the hex alphabet is a different fault. Either the string was never hex, or two fields have been joined, or a word has been picked up from the surrounding text. Look at where the bad character sits: at the very start or the very end suggests a selection that overshot into neighbouring content, while one in the middle suggests the string is not what it was labelled.

A run that is much longer than 128 characters is usually two values run together, sometimes a digest immediately followed by a filename with no space between them. That is a rendering fault in the page you are reading, not a claim about anybody.

None of these outcomes identifies a culprit. A wrong shape is a statement about the route a string took to reach you, and the route includes your own browser, your own clipboard and your own eyes.

What a correct shape does not prove

Begin with the ambiguity that no amount of format checking will remove. Sixty four hex characters is also the exact shape of a transaction id. It is the shape of a random identifier, a session key printed in hex, a block reference, and a hex encoded chunk of anything at all. The alphabet and the length are shared by all of them. Shape can tell you a string is capable of being a digest. It cannot tell you it is one.

Next, the comparison people actually perform. A digest printed on a page, matched against a digest printed on the same page, establishes that the page agrees with itself. The two strings travelled together, were served by the same host, and would be rewritten together by anything able to rewrite either. Self agreement is not independent confirmation, and it is the most common form of hash checking there is.

It does not prove any file exists. A digest is a string; there need be no file anywhere.
It does not prove the digest was computed from the file offered beside it. That link is an assertion made by the page.
It does not name the algorithm, so it does not tell you what to compute if you wanted to compare.
It says nothing about what the file contains, what it does, or where it came from.
It does not indicate who published the digest. There is no author inside a run of hex.
It does not carry a time. A digest from long ago and one from a moment ago are indistinguishable.
It does not survive as evidence of anything on its own, because it can be copied, retyped and republished without limit.

The residue after a successful shape check is small and worth stating plainly: you are holding a string that could be a digest of some 128, 160, 256 or 512 bit algorithm, and you know nothing else.

What this card is not

This card does not cover signatures. A digest and a signature are often printed in similar places and serve similar sounding purposes, but a signature has structure, an armour envelope and a relationship to a key, none of which a hash has. That shape lives on the detached signature card. The hex alphabet itself, and how it differs from base32, base58 and base64, is set out once on the alphabets page rather than repeated here.

Questions people send about this shape

Why are file hashes usually printed in lower case?

Convention, and nothing more. Hex is case insensitive, so an upper case digest and a lower case one with the same characters are the same value. Lower case became the default in printed output because it is less visually noisy over long runs. A digest printed in upper case is not wrong and not suspicious; it has simply been formatted differently by whatever produced the page.

Can a hash be shorter than 32 characters?

Yes. Some algorithms are defined at smaller sizes, and some output can be truncated deliberately to a shorter prefix for display. A short run of hex is therefore not automatically malformed. What it does mean is that the length no longer narrows the field usefully, so you are relying entirely on the label beside it to say what the string is.

Does this site compare hashes for you?

No. Nothing on this site computes, fetches or compares anything. The cards describe what a shape looks like so you can read a page more carefully. Any actual comparison of a digest against a file happens elsewhere, with your own tools, and this reference makes no claim about the result of such a comparison.

A file hash