Size of MD5 hash generated

Question

I would be using MD5 hashing to store encrypted passwords. Password can be 6 to 40 characters long. What is the database column size required for storing the encrypted password. Also, if 40 characters hash size is very large, then how much hash size would a 20 character password take?

I am using FormsAuthentication.HashPasswordForStoringInConfigFile(stringToEncrypt, "MD5"); to generate hash for storing in Database.

Eyrir

hashing != encrypting – Abarca

Also don't use MD5 for passwords. Use a computationally expensive hash algorithm like BCrypt or SCrypt so they are hard to reverse by brute force. – Tatouay

Answer 1

A hash algorithm always maps an arbitrary sized message to a fixed-length representation. In other words, you can hash an empty string or many gigabytes of information. The hash size is always fixed.

In your case the hash size is 128 bits. When converted to an ASCII string it would be a 32 character string that contains only hexadecimal digits.

Buckwheat

Thanks a lot. I will use a 32 char column to store the hashed password. – Eyrir

Remember, if you're manually hashing passwords, you're doing it wrong. Please use bcrypt. – Gingergingerbread

Answer 2

http://msdn.microsoft.com/en-us/library/system.security.cryptography.md5.aspx

The hash size for the MD5 algorithm is 128 bits, regardless of the length of the string being hashed.

Consider using a newer hashing functions like SHA 256.

Shaper

Or for storing passwords, use bcrypt. – Gingergingerbread

Answer 3

MD5 hashes are always exactly 16 bytes (128 bits) long, no matter how long the input is.

Gingergingerbread