MD5 is 128 bits but why is it 32 characters?

32 chars as hexdecimal representation, thats 2 chars per byte.

I wanted summerize some of the answers into one post.

First, don't think of the MD5 hash as a character string but as a hex number. Therefore, each digit is a hex digit (0-15 or 0-F) and represents four bits, not eight.

Taking that further, one byte or eight bits are represented by two hex digits, e.g. b'1111 1111' = 0xFF = 255.

MD5 hashes are 128 bits in length and generally represented by 32 hex digits.

SHA-1 hashes are 160 bits in length and generally represented by 40 hex digits.

For the SHA-2 family, I think the hash length can be one of a pre-determined set. So SHA-512 can be represented by 128 hex digits.

Again, this post is just based on previous answers.

A hex "character" (nibble) is different from a "character"

To be clear on the bits vs byte, vs characters.

• 1 byte is 8 bits (for our purposes)
• 8 bits provides 2**8 possible combinations: 256 combinations

When you look at a hex character,

• 16 combinations of [0-9] + [a-f]: the full range of 0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f
• 16 is less than 256, so one one hex character does not store a byte.
• 16 is 2**4: that means one hex character can store 4 bits in a byte (half a byte).
• Therefore, two hex characters, can store 8 bits, 2**8 combinations.
• A byte represented as a hex character is [0-9a-f][0-9a-f] and that represents both halfs of a byte (we call a half-byte a nibble).

When you look at a regular single-byte character, (we're totally going to skip multi-byte and wide-characters here)

• It can store far more than 16 combinations.
• The capabilities of the character are determined by the encoding. For instance, the ISO 8859-1 that stores an entire byte, stores all this stuff
• All that stuff takes the entire 2**8 range.
• If a hex-character in an md5() could store all that, you'd see all the lowercase letters, all the uppercase letters, all the punctuation and things like ¡°ÀÐàð, whitespace like (newlines, and tabs), and control characters (which you can't even see and many of which aren't in use).

So they're clearly different and I hope that provides the best break down of the differences.

MD5 yields hexadecimal digits (0-15 / 0-F), so they are four bits each. 128 / 4 = 32 characters.

SHA-1 yields hexadecimal digits too (0-15 / 0-F), so 160 / 4 = 40 characters.

(Since they're mathematical operations, most hashing functions' output is commonly represented as hex digits.)

You were probably thinking of ASCII text characters, which are 8 bits.

That's 32 hex characters - 1 hex character is 4 bits.