8

In Arch Linux, how can I create a single md5 hash for a password using the command line? Of course, I am aware that there are secure password hashing algorithms available, which md5 is not, but this is just part of an experiment.

3
  • 4
    You might remove the word "more" before "secure". As in, there are secure hashes out there (or at least hashes with some amount of security), MD5 isn't one of them. Sep 21, 2016 at 2:28
  • 2
    Just for the record, even a secure cryptographic hash like SHA-256 doesn't directly make a good password hash. I know you at least need something like a salt to defeat rainbow-table attacks, and I'm sure there are other issues that I'm not aware of. Sep 21, 2016 at 10:26
  • openssl passwd -1 for the $1$ md5 format.
    – KJ7LNW
    May 23, 2022 at 21:43

6 Answers 6

17

Simply echo it to md5sum.

The first result will consider a newline character in the end of the string, prior to generating the hash.

$ echo P@ssword1 | md5sum
0a43c426e3d6764fe1f3f7cbb3579eba  -

Otherwise as @AFH states if you wish to not have a newline character do the following:

$ echo -n 'P@ssword1' | md5sum
d106b29303767527fc11214f1b325fb6  -
7
  • 9
    This includes a new-line character along with the password: this may be what the questioner wants, but if not you need echo -n 'P@ssword1' | md5sum. I have included quotes in the password in case it includes characters which the shell interprets; I used single quotes to inhibit expansion if there is a $.
    – AFH
    Sep 20, 2016 at 14:56
  • 7
    This will return the wrong result, because you're not hashing P@ssword1, but P@ssword1<Newline>. Use echo -n P@ssword1 | md5sum instead.
    – phihag
    Sep 20, 2016 at 14:56
  • @AFH I expanded on the answer from your comment. Sep 20, 2016 at 14:58
  • 5
    "The first result will return a newline character with the hash." No, it'll consider a newline character when generating the hash, which is a very different thing! Sep 20, 2016 at 16:01
  • My working was off. Correct. Sep 20, 2016 at 16:01
11

None of the answers mention that with echo -n 'password' | …, you will write your password to persistent storage, namely your history.

You can avoid this, depending on the shell, by prefixing the command with a space (test this for your shell). Read up on your shells documentation on how this is handled.

Alternatively, you can use md5sum directly, by running md5sum, typing the password and then Ctrl+D. Do not hit Enter between the password and Ctrl+D, unless you want to have include a newline in the hash.

3
  • 1
    You started so well (+1)... but after you said that to write the plane password in a file works too (-1) 8-O (how many security holes it opens...). BTW if the variable $HISTCONTROL is set to ignorespace or to ignoreboth all the commands entered with a leading-space will not be stored in the history...Nonetheless it's always a good idea to test it directly. (+1 again :-) )...
    – Hastur
    Sep 21, 2016 at 10:22
  • @Hastur Good point. Writing to a file is generally better than having the password spilled in the history, because you can simply unlink the file (which may not work with the history, depending on configuration – I have seen shells which (re-)write the history on exit). You are however right that getting writing the password to a file right isn’t as easy as simply running vim or something (one would at least want to set the umask, and I don’t know for sure whether that leaves any holes). I removed the part from the answer. Sep 21, 2016 at 12:24
  • I notice your edit (but I've just upvoted I cannot twice, but I can think to something else...).
    – Hastur
    Sep 21, 2016 at 12:33
8

Here is an example using openssl

echo -n 'stack overflow' | openssl md5
(stdin)= 481b8423202598ecfb233c5fa68caf68

Openssl implement several different hashing algorithms, if you need a different one some day.

4

The question suggests something else to me, so for completeness:

There is an MD5-based salted password hashing method, which replaced the original DES-based crypt() for use in /etc/shadow. It has been replaced by newer things now, but if you ever encounter "MD5 password hashing" in the wild, it may refer to this rather than a plain MD5.

These MD5-based hashes are marked by the prefix $1$ and you can calculate them with openssl passwd -1

4

It seems like everyone is suggesting to use echo -- at least, most of the time, thankfully, with -n, which alleviates one of its problems (that it prints a newline at the end).

But echo isn't necessarily consistent. It has a number of behavioral quirks that you need to keep in mind, and can be incompatible between systems. It's better to use printf instead.

Hence, you should be using

$ printf '%s' 'P@ssword1' | md5sum
d106b29303767527fc11214f1b325fb6  -
$

With printf, if you want a newline at the end, you have to explicitly add it yourself:

$ printf '%s\n' 'P@ssword1' | md5sum
0a43c426e3d6764fe1f3f7cbb3579eba  -
$ echo 'P@ssword1' | md5sum
0a43c426e3d6764fe1f3f7cbb3579eba  -
$

instead of having to ask to not get it (and hoping echo works the same on the system this happens to be running on at some later point):

$ echo -n 'P@ssword1' | md5sum
d106b29303767527fc11214f1b325fb6  -
$

To expand on the point on the quirks of echo that I mentioned above, here are a few:

  • It works differently on various systems. Many modern systems support -n to tell echo to not terminate the output with a newline, but some might not. And what if you want to actually print -n? Some implementations might actually differ based on settings in the shell or environment.
  • It handles, or might not handle, some character sequences (particularly backslash-escaped characters) in a special way. It's not entirely unreasonable to have those in passwords, and POSIX doesn't guarantee anything about the behavior of echo (its behavior is specifically undefined) if the first argument is -n or any of its arguments contain backslashes.

The answers to the above-linked question on using printf instead of echo have several more, as well as further links for more reading if you are curious.

5
  • "It (echo) has a number of behavioral quirks that you need to keep in mind" Can you expand on this?
    – DavidPostill
    Sep 23, 2016 at 6:58
  • @DavidPostill I added a bit on that. Do you feel that this is better?
    – user
    Sep 23, 2016 at 18:12
  • Perfect :) It was for my own education (I didn't want to imply there was anything wrong with your answer).
    – DavidPostill
    Sep 23, 2016 at 18:14
  • @DavidPostill No worries; I like to try to make my answers as good as they can reasonably be, even when they aren't the top voted ones! (I didn't expect this to garner significant attention even when I started writing it, but felt it was worth having an answer discussing how printf is probably a better choice than echo particularly for something like this.)
    – user
    Sep 23, 2016 at 18:19
  • That goes for me too :)
    – DavidPostill
    Sep 23, 2016 at 18:20
0

You can easily do this using echo and md5sum:

 echo -n "password" | md5sum
1
  • 2
    Without -n the echo will append the newline character to the output, so, the hash will be incorrect. For instance, for echo -n lolwut | md5sum the result is 05a208028929fd77cfb5b08096a837df, while for echo lolwut | md5sum it's f291ceceddd9e13a0ab68cf1829ef583. Sep 20, 2016 at 15:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .