MD2 Hash Generator

MD2 hash generator for legacy work

MD2 is the first of Ron Rivest’s “Message Digest” functions, published in 1989 and specified in RFC 1319. This MD2 hash generator computes the 128-bit MD2 digest of any text or file and prints it as 32 hexadecimal characters. It is implemented directly from the RFC, because MD2 is so old that most modern crypto libraries no longer include it.

Example

Input:

The quick brown fox jumps over the lazy dog

MD2:

03d85a0d629d2c442e987525319fc471

The MD2 of an empty string is 8350e5a3e24c153df2275c9f80692773 — a standard test vector from RFC 1319 that you can use to confirm any implementation.

Algorithm at a glance

How MD2 works

MD2 was designed for the 8-bit computers of its time, so it works one byte at a time rather than on 32-bit words. The message is padded to a multiple of 16 bytes, a 16-byte checksum is appended, and then each block is mixed into a 48-byte state over 18 rounds using the π-based substitution table. The first 16 bytes of the final state are the digest. This byte-by-byte design makes MD2 very slow compared with later hashes.

Security status

MD2 is broken and must not be used to protect anything. Researchers have published preimage attacks that are far faster than brute force and collision attacks against its compression function, and it has been deprecated for digital signatures for many years. Its 128-bit output is also too short by modern standards.

Legitimate uses today

• Reading or verifying very old X.509 certificates and PKCS #1 signatures that used md2WithRSAEncryption.
• Testing parsers, forensic tools and crypto libraries against published MD2 test vectors.
• Teaching the history of hash function design.

For new work, use SHA-256 or SHA3-256. If you only need a fast checksum to detect accidental changes, CRC-32 is far quicker. For passwords, use a dedicated password hash such as bcrypt instead of any general-purpose hash.

Hashing runs locally in your browser; text and files are not uploaded.

Computing MD2 in other tools

When you need to reproduce a legacy MD2 value in code, support is patchy:

• PHP: hash('md2', $data) is still available in the standard hash extension.
• Java: MessageDigest.getInstance("MD2") works with the default provider.
• Python: hashlib usually lacks MD2; the PyCryptodome package provides Crypto.Hash.MD2.
• OpenSSL: MD2 is disabled in standard builds, so openssl dgst -md2 normally fails.

Whatever you use, check it first with the empty-string test vector above. Then use the Compare with an expected hash box here to confirm that both sides agree on a real input.