Match an MD5, SHA-1 or SHA-256 hash
Recognize an MD5, SHA-1 or SHA-256 hex digest by length alone — 32, 40 or 64 characters — useful for scanning logs and commit messages for checksums.
Last updated
Matches
- sha256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 is empty
- sha1 da39a3ee5e6b4b0d3255bfef95601890afd80709 is empty
- md5 d41d8cd98f00b204e9800998ecf8427e is empty
Doesn’t match
- too short abc123
- 31charshexaaaaaaaaaaaaaaaaaaaaaaa
Why it’s written this way
All three algorithms produce a fixed-length run of hex characters, so the pattern is really just three length-gated alternatives — 64 hex characters for SHA-256, 40 for SHA-1, 32 for MD5 — each wrapped in \b so it only matches whole tokens, not a slice out of a longer hex string.
The alternatives are listed longest-first on purpose. Regex alternation tries each branch left to right and stops at the first success, so ordering by length reads naturally as 'check for the biggest hash first' even though the trailing \b already prevents a shorter alternative from matching partway through a longer run — it is defensive style as much as strict necessity.
Edge cases to know
- →Length is the only signal here — any 32, 40 or 64-character hex string matches, including one that is not a hash of anything in particular, or one produced by a different algorithm that happens to share a digest length (SHA-1 and RIPEMD-160 are both 40 hex characters).
- →It only matches lowercase and uppercase hex mixed freely; it does not verify the hash actually corresponds to the file or string it is claimed to describe.
- →MD5 and SHA-1 are cryptographically broken for security purposes — matching one in the wild is a good moment to flag it for replacement, not just to parse it.