🔐
Crypto & Hashing Cheatsheet
SHA, MD5, HMAC output sizes, AES key lengths, bcrypt cost factor reference.
Hash Algorithm Reference
| Algorithm | Output Size | Hex Chars | Security Status |
|---|---|---|---|
| MD5 | 128-bit | 32 | Broken — collision attacks exist. Do not use for security. |
| SHA-1 | 160-bit | 40 | Deprecated — collision demonstrated in 2017. Avoid. |
| SHA-256 | 256-bit | 64 | Secure — recommended for general use. |
| SHA-384 | 384-bit | 96 | Secure — higher security margin. |
| SHA-512 | 512-bit | 128 | Secure — highest standard SHA-2 variant. |
| SHA3-256 | 256-bit | 64 | Secure — Keccak-based, independent of SHA-2. |
| BLAKE2b | 512-bit (max) | 128 | Secure — faster than SHA-2 in software. |
bcrypt Reference
| Property | Value |
|---|---|
| Output length | 60 characters |
| Output format | $2b$[cost]$[22-char salt][31-char hash] |
| Salt length | 128 bits (22 base-64 chars) |
| Cost factor 10 | ~100ms on modern hardware — recommended minimum |
| Cost factor 12 | ~400ms — recommended for high-security apps |
| Cost factor 14 | ~1.5s — high-security, low-volume |
| Max password length | 72 bytes (bcrypt truncates beyond this) |
AES Key Sizes
| Variant | Key Size | Rounds | Use Case |
|---|---|---|---|
| AES-128 | 128-bit (16 bytes) | 10 | General-purpose, fast, NIST approved |
| AES-192 | 192-bit (24 bytes) | 12 | Rarely used — middle ground |
| AES-256 | 256-bit (32 bytes) | 14 | High-security, TLS 1.3, recommended |
Always use authenticated encryption (AES-GCM) rather than AES-CBC without authentication.
HMAC Quick Reference
| HMAC Variant | Output Length | Common Use |
|---|---|---|
| HMAC-MD5 | 128-bit | Legacy; avoid for security |
| HMAC-SHA1 | 160-bit | OAuth 1.0a (legacy); avoid where possible |
| HMAC-SHA256 | 256-bit | JWT HS256, webhook signatures, API auth |
| HMAC-SHA512 | 512-bit | High-security signing, JWT HS512 |