md5

(PHP 4, PHP 5, PHP 7)

md5 — 计算字符串的 MD5 散列值

Warning

It is not recommended to use this function to secure passwords, due to the fast nature of this hashing algorithm. See the Password Hashing FAQ for details and best practices.

说明

md5 ( string $str [, bool $raw_output = FALSE ] ) : string

使用 » RSA 数据安全公司的 MD5 报文算法计算 str 的 MD5 散列值。

参数

str

原始字符串。

raw_output

如果可选的 raw_output 被设置为 TRUE，那么 MD5 报文摘要将以16字节长度的原始二进制格式返回。

返回值

以 32 字符十六进制数字形式返回散列值。

范例

Example #1 md5() 范例

<?php
$str = 'apple';

if (md5($str) === '1f3870be274f6c49b3e31a0c6728957f') {
    echo "Would you like a green or red apple?";
}
?>

参见

  • md5_file() - 计算指定文件的 MD5 散列值
  • sha1_file() - 计算文件的 sha1 散列值
  • crc32() - 计算一个字符串的 crc32 多项式
  • sha1() - 计算字符串的 sha1 散列值
  • hash() - 生成哈希值 （消息摘要）
  • crypt() - 单向字符串散列
  • password_hash() - 创建密码的散列（hash）

User Contributed Notes

Steve M 10-Jan-2020 02:20
I've found multiple sites suggesting the code:

md5(file_get_contents($filename));

Until recently, I hadn't noticed any issues with this locally... but then I tried to hash a 700MB file, with a 2048MB memory limit and kept getting out of memory errors...

There appears to be a limit to how long a string the md5() function can handle, and the alternative function is likely more memory efficient anyway. I would highly recommend to all who need file hashing (for detecting duplicates, not security digests) use the md5_file() function and NOT the regular string md5() function!

md5_file($filename);

Note, to those interested, as this was for a local application not a server, I was more concerned with results than memory efficiency. In a live environment, you would never want to read an entire file into memory at once when avoidable. (at the time of coding, I did not know of the alternative function)
Ken Guest 14-May-2019 03:30
Use the strict comparision/identity operator:

php > var_dump(md5('240610708') == md5('QNKCDZO'));
php shell code:1:
bool(true)
php > var_dump(md5('240610708') === md5('QNKCDZO'));
php shell code:1:
bool(false)
php >

because, as mentioned previously, using the equality operator may result in false positives.
Ray.Paseur sometimes uses Gmail 01-Dec-2018 05:10
md5('240610708') == md5('QNKCDZO')

This comparison is true because both md5() hashes start '0e' so PHP type juggling understands these strings to be scientific notation.  By definition, zero raised to any power is zero.
hkmaly 27-Nov-2017 10:11
Note: Before you get some idea like using md5 with password as way to prevent others tampering with message, read pages "Length extension attack" and "Hash-based message authentication code" on wikipedia. In short, naive constructions can be dangerously insecure. Use hash_hmac if available or reimplement HMAC properly without shortcuts.
radon8472 at radon-software dot net 18-Apr-2016 02:10
<?php
    function raw2hex($rawBinaryChars)
    {
      return = array_pop(unpack('H*', $rawBinaryChars));
    }
?>

The complement of hey2raw.
You can use to convert from raw md5-format to human-readable format.

This can be usefull to check "Content-Md5" HTTP-Header.

<?php
  $rawMd5    = base64_decode($_SERVER['HTTP_CONTENT_MD5']);
  $post_data = file_get_contents("php://input");

  if(raw2hex($rawMd5) == md5($post_data)) // Post-Data is okay
  else                                    // Post-Data is currupted
?>
John 17-Nov-2009 03:08
If you want to hash a large amount of data you can use the hash_init/hash_update/hash_final functions.

This allows you to hash chunks/parts/incremental or whatever you like to call it.
dionyziz at deviantart dot com 11-Aug-2007 12:24
Sometimes it's useful to get the actual, binary, md5 digest.
You can use this function for it:

<?php

function md5bin( $target ) {
    $md5 = md5( $target );
    $ret = '';

    for ( $i = 0; $i < 32; $i += 2 ) {
        $ret .= chr( hexdec( $md5{ $i + 1 } ) + hexdec( $md5{ $i } ) * 16 );
    }

    return $ret;
}

?>
terry _at_ scribendi_com 28-Apr-2005 07:39
Do not use the hex strings returned by md5() as a key for MCrypt 256-bit encryption.  Hex characters only represent four bits each, so when you take 32 hex characters, you are only really using a 128-bit key, not a 256-bit one. 

Using an alphanumeric key generator [A-Za-z0-9] will also only provide a 192-bit key in 32 characters.

Two different MD5s concatenated in raw binary form, or mcrypt_create_iv(32,MCRYPT_DEV_RANDOM) will give you a true 256-bit key string.
Shane Allen 14-Apr-2003 08:53
From the documentation on Digest::MD5:
md5($data,...)
This function will concatenate all arguments, calculate the MD5 digest of this "message", and return it in binary form.

md5_hex($data,...)
Same as md5(), but will return the digest in hexadecimal form.

PHP's function returns the digest in hexadecimal form, so my guess is that you're using md5() instead of md5_hex(). I have verified that md5_hex() generates the same string as PHP's md5() function.

(original comment snipped in various places)
>Hexidecimal hashes generated with Perl's Digest::MD5 module WILL
>NOT equal hashes generated with php's md5() function if the input
>text contains any non-alphanumeric characters.
>
>$phphash = md5('pa$$');
>echo "php original hash from text: $phphash";
>echo "md5 hash from perl: " . $myrow['password'];
>
>outputs:
>
>php original hash from text: 0aed5d740d7fab4201e885019a36eace
>hash from perl: c18c9c57cb3658a50de06491a70b75cd