Hash Output Lengths Compared

Different hash algorithms produce different-length outputs, and this length directly impacts security, storage requirements, and sometimes performance. Understanding these differences helps you choose the right algorithm for your use case.

Output lengths at a glance:

MD5: 128 bits = 16 bytes = 32 hex characters. SHA-1: 160 bits = 20 bytes = 40 hex characters. SHA-224: 224 bits = 28 bytes = 56 hex characters. SHA-256: 256 bits = 32 bytes = 64 hex characters. SHA-384: 384 bits = 48 bytes = 96 hex characters. SHA-512: 512 bits = 64 bytes = 128 hex characters. SHA-512/256: 256 bits = 32 bytes = 64 hex characters (truncated SHA-512). SHA-3-256: 256 bits = 32 bytes = 64 hex characters.

How length relates to security:

The collision resistance of a hash function is at most half its output length in bits (due to the birthday paradox). MD5's 128-bit output provides at most 64 bits of collision resistance (and in practice far less due to cryptanalytic attacks). SHA-256's 256-bit output provides 128 bits of collision resistance, which is considered the minimum for long-term security. SHA-512 provides 256 bits of collision resistance, offering a margin against potential future advances including quantum computing.

Storage and bandwidth implications:

Storing SHA-256 hashes requires exactly twice the space of MD5 hashes (32 bytes vs 16 bytes, or 64 vs 32 hex characters). For a database with millions of records, this difference can be significant. SHA-512 requires four times MD5's storage. When hashes are transmitted in URLs, headers, or API responses, shorter hashes reduce bandwidth. However, storage and bandwidth are cheap compared to the cost of a security breach, so always prioritize security.

Encoding formats:

Hashes are typically represented in hexadecimal (2 characters per byte) or Base64 (4 characters per 3 bytes). In hex, SHA-256 is 64 characters; in Base64, it is 44 characters (including padding). Choosing Base64 encoding can reduce the storage footprint by about 33% compared to hex. Some systems use raw binary representation for maximum compactness.

Choosing the right length:

For security applications, use at least 256-bit output (SHA-256 or higher). For non-security fingerprinting where you need compact identifiers, shorter hashes or truncated SHA-256 may be acceptable, but document the collision probability for your expected data volume.