In Arch Linux, how can I create a single md5 hash for a password using the command line? Of course, I am aware that there are secure password hashing algorithms available, which md5 is not, but this is just part of an experiment.
-
4You might remove the word "more" before "secure". As in, there are secure hashes out there (or at least hashes with some amount of security), MD5 isn't one of them.– Todd WilcoxSep 21, 2016 at 2:28
-
2Just for the record, even a secure cryptographic hash like SHA-256 doesn't directly make a good password hash. I know you at least need something like a salt to defeat rainbow-table attacks, and I'm sure there are other issues that I'm not aware of.– Peter CordesSep 21, 2016 at 10:26
-
openssl passwd -1 for the $1$ md5 format.– KJ7LNWMay 23, 2022 at 21:43
6 Answers
Simply echo
it to md5sum.
The first result will consider a newline character in the end of the string, prior to generating the hash.
$ echo P@ssword1 | md5sum
0a43c426e3d6764fe1f3f7cbb3579eba -
Otherwise as @AFH states if you wish to not have a newline character do the following:
$ echo -n 'P@ssword1' | md5sum
d106b29303767527fc11214f1b325fb6 -
-
9This includes a new-line character along with the password: this may be what the questioner wants, but if not you need
echo -n 'P@ssword1' | md5sum
. I have included quotes in the password in case it includes characters which the shell interprets; I used single quotes to inhibit expansion if there is a$
.– AFHSep 20, 2016 at 14:56 -
7This will return the wrong result, because you're not hashing
P@ssword1
, butP@ssword1<Newline>
. Useecho -n P@ssword1 | md5sum
instead.– phihagSep 20, 2016 at 14:56 -
-
5"The first result will return a newline character with the hash." No, it'll consider a newline character when generating the hash, which is a very different thing! Sep 20, 2016 at 16:01
-
None of the answers mention that with echo -n 'password' | …
, you will write your password to persistent storage, namely your history.
You can avoid this, depending on the shell, by prefixing the command with a space (test this for your shell). Read up on your shells documentation on how this is handled.
Alternatively, you can use md5sum
directly, by running md5sum
, typing the password and then Ctrl+D. Do not hit Enter between the password and Ctrl+D, unless you want to have include a newline in the hash.
-
1You started so well (+1)... but after you said that to write the plane password in a file works too (-1)
8-O
(how many security holes it opens...). BTW if the variable$HISTCONTROL
is set to ignorespace or to ignoreboth all the commands entered with a leading-space will not be stored in the history...Nonetheless it's always a good idea to test it directly. (+1 again :-) )...– HasturSep 21, 2016 at 10:22 -
@Hastur Good point. Writing to a file is generally better than having the password spilled in the history, because you can simply unlink the file (which may not work with the history, depending on configuration – I have seen shells which (re-)write the history on exit). You are however right that getting writing the password to a file right isn’t as easy as simply running vim or something (one would at least want to set the umask, and I don’t know for sure whether that leaves any holes). I removed the part from the answer. Sep 21, 2016 at 12:24
-
I notice your edit (but I've just upvoted I cannot twice, but I can think to something else...).– HasturSep 21, 2016 at 12:33
Here is an example using openssl
echo -n 'stack overflow' | openssl md5
(stdin)= 481b8423202598ecfb233c5fa68caf68
Openssl implement several different hashing algorithms, if you need a different one some day.
The question suggests something else to me, so for completeness:
There is an MD5-based salted password hashing method, which replaced the original DES-based crypt() for use in /etc/shadow
. It has been replaced by newer things now, but if you ever encounter "MD5 password hashing" in the wild, it may refer to this rather than a plain MD5.
These MD5-based hashes are marked by the prefix $1$
and you can calculate them with openssl passwd -1
It seems like everyone is suggesting to use echo
-- at least, most of the time, thankfully, with -n
, which alleviates one of its problems (that it prints a newline at the end).
But echo
isn't necessarily consistent. It has a number of behavioral quirks that you need to keep in mind, and can be incompatible between systems. It's better to use printf
instead.
Hence, you should be using
$ printf '%s' 'P@ssword1' | md5sum
d106b29303767527fc11214f1b325fb6 -
$
With printf
, if you want a newline at the end, you have to explicitly add it yourself:
$ printf '%s\n' 'P@ssword1' | md5sum
0a43c426e3d6764fe1f3f7cbb3579eba -
$ echo 'P@ssword1' | md5sum
0a43c426e3d6764fe1f3f7cbb3579eba -
$
instead of having to ask to not get it (and hoping echo
works the same on the system this happens to be running on at some later point):
$ echo -n 'P@ssword1' | md5sum
d106b29303767527fc11214f1b325fb6 -
$
To expand on the point on the quirks of echo
that I mentioned above, here are a few:
- It works differently on various systems. Many modern systems support
-n
to tellecho
to not terminate the output with a newline, but some might not. And what if you want to actually print-n
? Some implementations might actually differ based on settings in the shell or environment. - It handles, or might not handle, some character sequences (particularly backslash-escaped characters) in a special way. It's not entirely unreasonable to have those in passwords, and POSIX doesn't guarantee anything about the behavior of echo (its behavior is specifically undefined) if the first argument is
-n
or any of its arguments contain backslashes.
The answers to the above-linked question on using printf instead of echo have several more, as well as further links for more reading if you are curious.
-
"It (echo) has a number of behavioral quirks that you need to keep in mind" Can you expand on this?– DavidPostill ♦Sep 23, 2016 at 6:58
-
-
Perfect :) It was for my own education (I didn't want to imply there was anything wrong with your answer).– DavidPostill ♦Sep 23, 2016 at 18:14
-
@DavidPostill No worries; I like to try to make my answers as good as they can reasonably be, even when they aren't the top voted ones! (I didn't expect this to garner significant attention even when I started writing it, but felt it was worth having an answer discussing how printf is probably a better choice than echo particularly for something like this.)– userSep 23, 2016 at 18:19
-
You can easily do this using echo
and md5sum
:
echo -n "password" | md5sum
-
2Without
-n
theecho
will append the newline character to the output, so, the hash will be incorrect. For instance, forecho -n lolwut | md5sum
the result is05a208028929fd77cfb5b08096a837df
, while forecho lolwut | md5sum
it'sf291ceceddd9e13a0ab68cf1829ef583
. Sep 20, 2016 at 15:40