MD5(1)

📦
version 199 · 2 versions
, in nixpkgs unstable

💫 MD5(1) — the manual, but make it a vibe 💫

Okay so bestie, we're talking about the MD5(1) page from the General Commands Manual — this is the one that covers all your hash besties: md5, sha1, sha224, sha256, sha384, sha512, and their sum counterparts. It's giving "cryptographic fingerprint realness" and honestly? Iconic. Let's get into it. 🎀

✨ NAME ✨

So the whole squad is here:

  • md5
  • sha1
  • sha224
  • sha256
  • sha384
  • sha512
  • md5sum
  • sha1sum
  • sha224sum
  • sha256sum
  • sha384sum
  • sha512sum

And what do they all do? They calculate a message-digest fingerprint (aka a checksum) for a file. No cap, that's the whole job. 🧚

🦋 SYNOPSIS 🦋

Here's the tea on how you call these bad boys:

md5 [-pqrtx] [-c string] [-s string] [file ...]

md5sum [-bctwz] [--binary] [--check] [--help] [--ignore-missing]
    [--quiet] [--status] [--strict] [--tag] [--text] [--version]
    [--warn] [--zero] [file ...]

    (All other hashes have the same options and usage.)

shasum [-0bchqstUvw] [--01] [-a | --algorithm alg] [--binary] [--check]
    [--help] [--ignore-missing] [--quiet] [--status] [--strict] [--tag]
    [--text] [--UNIVERSAL] [--version] [--warn] [file ...]

Periodt. Copy it exactly, bestie. 💅

🌸 DESCRIPTION 🌸

So like, the md5, sha1, sha224, sha256, sha384, and sha512 utilities take a message of literally any length and spit out a “fingerprint” or “message digest” of that input. It's giving "unique snowflake" but for data. ❄️

The md5sum, sha1sum, sha224sum, sha256sum, sha384sum, and sha512sum utilities do the exact same thing, but with command-line options and an output format that matches their similarly named GNU utilities. (Yes, the original says "similary" — we don't fix typos, we just notice them. 🙈)

In all cases, each file listed on the command line is processed separately. And if you don't list any files? Or if a file name is given as -? Then input is taken from stdin instead. Slay. 🫶

Okay so now the science-y part: it is conjectured that it is computationally infeasible to produce two messages having the same message digest, or to produce any message having a given prespecified target message digest. Basically, collisions are supposed to be not it. The SHA-224, SHA-256, SHA-384, and SHA-512 algorithms are intended for digital signature applications, where a large file must be “compressed” in a secure manner before being encrypted with a private (secret) key under a public-key cryptosystem such as RSA. Fancy. 👑

⚠️ Real talk, bestie: The MD5 and SHA-1 algorithms have been proven to be vulnerable to practical collision attacks. They should not be relied upon to produce unique outputs, nor should they be used as part of a cryptographic signature scheme. As of 2017-03-02, there is no publicly known method to reverse either algorithm, i.e., to find an input that produces a specific output. So like, don't use them for security stuff. 💀

It is recommended that all new applications use SHA-512 instead of one of the other hash functions. That's the main character of hashes, fr fr. 🌈

💜 BSD OPTIONS 💜

These are the options available in BSD mode — that's when the program is invoked with a name that does not end in “sum”:

  • -c string, --check=string — Compare the digest of the file against this string. If combined with the -q or --quiet option, the calculated digest is printed in addition to the exit status being set. (Note that this option is not yet useful if multiple files are specified.) — lowkey limited but still valid. 🎀
  • -p, --passthrough — Echo stdin to stdout and append the checksum to stdout. In this mode, any files specified on the command line are silently ignored. — it's giving "I'm just gonna ignore that". 🙈
  • -q, --quiet — Quiet mode — only the checksum is printed out. Overrides the -r or --reverse option. — shhh, only the hash speaks. 🤫
  • -r, --reverse — Reverses the format of the output. This helps with visual diffs. Does nothing when combined with the -ptx options. — aesthetic choice only, we respect it. ✨
  • -s string, --string=string — Print a checksum of the given string. In this mode, any files specified on the command line are silently ignored. — string-only, no files allowed, periodt. 💅
  • -t, --time-trial — Run a built-in time trial. For the -sum versions, this is a nop for compatibility with coreutils. — it's giving "we tried". ⏱️
  • -x, --self-test — Run a built-in test script. — self-care check, literally. 🧖

🔥 GNU OPTIONS 🔥

These are the options available in GNU mode — that's when the program is invoked with a name that ends in “sum”:

  • -b, --binary — Read files in binary mode. — bytes are bytes, bestie. 💾
  • -c, --check — The file passed as arguments must contain digest lines generated by the same digest algorithm in either classical BSD format or in GNU coreutils format. A line with the file name followed by a colon “:” and either OK or FAILED is written for each well-formed line in the digest file. If applicable, the number of failed comparisons and the number of lines that were skipped since they were not well-formed are printed at the end. The --quiet option can be used to quiesce the output unless there are mismatched entries in the digest. — this is the verification era. ✅
  • --help — Print a usage message and exit. — when in doubt, ask for help. 🆘
  • --ignore-missing — When verifying checksums, ignore files for which checksums are given but which aren't found on disk. — if it's not there, we pretend it never was. 🫥
  • --quiet — When verifying checksums, do not print anything unless the verification fails. — silent unless it's tea time. ☕
  • --status — When verifying checksums, do not print anything at all. The exit code will reflect whether verification succeeded. — the exit code is the only messenger. 📬
  • --strict — When verifying checksums, fail if the input is malformed. — no sloppy input allowed. 🚫
  • --tag — Produce BSD-style output. — switch the aesthetic, slay. 🎨
  • -t, --text — Read files in text mode. This is the default. Note that this implementation does not differentiate between binary and text mode. — default vibes, no diff. 📝
  • --version — Print version information and exit. — know your roots. 🌱
  • -w, --warn — When verifying checksums, warn about malformed input. — a gentle heads-up. ⚠️
  • -z, --zero — Terminate output lines with NUL rather than with newline. — zero chill, zero newline. 0️⃣

🎀 EXIT STATUS 🎀

So like, exit codes matter, bestie:

  • The md5, sha1, sha224, sha256, sha384, and sha512 utilities exit 0 on success, 1 if at least one of the input files could not be read, and 2 if at least one file does not have the same hash as the -c option.
  • The md5sum, sha1sum, sha224sum, sha256sum, sha384sum, and sha512sum utilities exit 0 on success and 1 if at least one of the input files could not be read or, when verifying checksums, does not have the expected checksum.

No cap, those numbers are the whole mood. 💯

🌈 EXAMPLES 🌈

Okay so let's get into the practical slay. 🧚‍♀️

Calculate the MD5 checksum of the string “Hello”.

$ md5 -s Hello
MD5 ("Hello") = 8b1a9953c4611296a827abf8c47804d7

Same as above, but note the absence of the newline character in the input string:

$ echo -n Hello | md5
8b1a9953c4611296a827abf8c47804d7

Calculate the checksum of multiple files reversing the output:

$ md5 -r /boot/loader.conf /etc/rc.conf
ada5f60f23af88ff95b8091d6d67bef6 /boot/loader.conf
d80bf36c332dc0fdc479366ec3fa44cd /etc/rc.conf

This is almost but not quite identical to the output from GNU mode:

$ md5sum /boot/loader.conf /etc/rc.conf
ada5f60f23af88ff95b8091d6d67bef6  /boot/loader.conf
d80bf36c332dc0fdc479366ec3fa44cd  /etc/rc.conf

Note the two spaces between hash and file name. If binary mode is requested, they are instead separated by a space and an asterisk:

$ md5sum -b /boot/loader.conf /etc/rc.conf
ada5f60f23af88ff95b8091d6d67bef6 */boot/loader.conf
d80bf36c332dc0fdc479366ec3fa44cd */etc/rc.conf

Write the digest for /boot/loader.conf in a file named digest. Then calculate the checksum again and validate it against the checksum string extracted from the digest file:

$ md5 /boot/loader.conf > digest && md5 -c $(cut -f2 -d= digest) /boot/loader.conf
MD5 (/boot/loader.conf) = ada5f60f23af88ff95b8091d6d67bef6

Same as above but comparing the digest against an invalid string (“randomstring”), which results in a failure.

$ md5 -c randomstring /boot/loader.conf
MD5 (/boot/loader.conf) = ada5f60f23af88ff95b8091d6d67bef6 [ Failed ]

In GNU mode, the -c option does not compare against a hash string passed as parameter. Instead, it expects a digest file, as created under the name digest for /boot/loader.conf in the example above.

$ md5 -c digest /boot/loader.conf
/boot/loader.conf: OK

The digest file may contain any number of lines in the format generated in either BSD or GNU mode. If a hash value does not match the file, “FAILED” is printed instead of “OK”.

🫶 SEE ALSO 🫶

Like, go check these out when you're done:

Also these iconic papers:

👑 ACKNOWLEDGMENTS 👑

This utility was originally derived from a program which was placed in the public domain for free general use by RSA Data Security. Respect the origins. 🙏

  • Support for SHA-1 was added by Oliver Eikemeier <eik@FreeBSD.org>.
  • Support for SHA-2 was added by Colin Percival <cperciva@FreeBSD.org> and Allan Jude <allanjude@FreeBSD.org>.
  • Compatibility with GNU coreutils was added by Warner Losh <imp@FreeBSD.org> and much expanded by Dag-Erling Smørgrav <des@FreeBSD.org>.

And that's the whole page, bestie. This manual comes from the Debian distribution, dated February 13, 2024, and it's the MD5(1) page — so now you know all the lore. Go forth and checksum responsibly. 💖✨🎀🦋🌸💅🫶😭🔥👑🌈⭐💀🙈🍓🧚💜

📦 where this page comes from