MD5, SHA and htpasswd hashes
MD5 and SHA hashes of text or a file, a check against a known hash, an .htpasswd line.
A line for .htpasswd — basic authentication in nginx and Apache.
MD5 and SHA-1 are for checking files only: they are broken for passwords and signatures.
Enter a user name and a password
Calculated in your browser — nothing is sent to the server
Practice on a machine
Lab “The portal fails over HTTPS”
In a Linux terminal
sha256sum ubuntu.iso
# a file's hash
sha256sum -c SHA256SUMS --ignore-missing
# check files against a list of hashes
md5sum file; sha512sum file
# other algorithms
htpasswd -B -C 12 /etc/nginx/.htpasswd admin
# bcrypt line, apache2-utils package
Keep in mindecho adds a line break, and the hash comes out different: in a terminal use echo -n or printf.
The hash differs from the terminal
echo adds a line break: echo 'hello' | sha256sum hashes “hello\n”. Use echo -n or turn on
“Line break at the end”. Check a file from Windows (another encoding, \r\n line endings) in the
“File” mode.
FAQ
Can passwords be stored as MD5 or SHA-256?
No: these hashes are fast, and a graphics card tries billions of guesses a second. Passwords are stored with slow salted hashes: bcrypt, yescrypt, Argon2.
How do I verify a downloaded file's checksum?
Choose the file and paste the hash from the site into “Compare with the expected hash”: a green line means
the file matches bit for bit. In the terminal, use sha256sum -c.
Why is the bcrypt line different every time?
It stores a random salt, so one password gives different lines. All of them are valid: the server takes the salt from the line.