Is there any built-in function to generate MD5 of string in JavaScript/jQuery?

Question

I am designing a login page as

<div id="body">
    <form class="form-horizontal">
        <div class="control-group">
            <label class="control-label" for="inputUser">Email</label>

            <div class="controls">
                <input type="text" id="inputUser" placeholder="Username">
            </div>
        </div>
        <div class="control-group">
            <label class="control-label" for="inputPassword">Password</label>

            <div class="controls">
                <input type="text" id="inputPassword" placeholder="Password">
            </div>
        </div>
        <div class="control-group">
            <div class="controls">
                <button id="login_button" type="submit" class="btn btn-success">Sign In</button>
            </div>
        </div>
        <div class="control-group">
            <div class="controls">
                <div id="login_status"></div>
            </div>
        </div>

    </form>
</div>

I am using Backbone.js with jQuery to interact with server.

I want to do MD5 hash of the password before sending it to server, is there any built-in function provided by Javascript or jQuery?

Why would you hash it on the client side? It should be sent over HTTPS anyway, and then hashed with a salt on the server side. — Michael Berkowski, Jan 02 '13 at 21:20
exact duplicate of: http://stackoverflow.com/questions/1323925/is-there-a-working-md5-plugin-or-equivalent-encryption-plugin-for-jquery-1-3-2 — Colleen, Jan 02 '13 at 21:21
Don't know if there's anything built into Backbone, but there's an MD5 implementation at http://code.google.com/p/crypto-js/. What's the motivation for hashing client-side? — E.Z. Hart, Jan 02 '13 at 21:21
...anyway [this question](http://stackoverflow.com/questions/1655769/fastest-md5-implementation-in-javascript) has a number of native JS implementations, though not via a built-in function. — Michael Berkowski, Jan 02 '13 at 21:21
I don't think hashing a password on the client side is a very secure idea. — gen_Eric, Jan 02 '13 at 21:24
Hashing to MD5 is useless, because it can be easily reverted to it's original value using Rainbow Tables. The best you can do using code is sha256 it with a salt defined with the server, but since it's also visible on the client side, it's also visible for any hacker watching the network. The only best solution is https. — Cyril N., Jan 02 '13 at 21:27
For jQuery you can use this: https://github.com/placemarker/jQuery-MD5. — Igor Timoshenko, Jan 02 '13 at 21:31
I would say hashing on the client-side does give some benefits. It can help keep the password secret even for the server. In an ideal world the password would never leave the client and only be used to generate a token from which the server can use to verify that the client indeed knows the password. — Stijn de Witt, Jul 19 '14 at 19:39

score 6 · Accepted Answer · answered Jan 02 '13 at 21:25

there is no native functions, but u can use this function for md5 convert on client - side original by: Webtoolkit.info (http://www.webtoolkit.info/)

function md5 ( str ) {

    var RotateLeft = function(lValue, iShiftBits) {
            return (lValue<<iShiftBits) | (lValue>>>(32-iShiftBits));
        };

    var AddUnsigned = function(lX,lY) {
            var lX4,lY4,lX8,lY8,lResult;
            lX8 = (lX & 0x80000000);
            lY8 = (lY & 0x80000000);
            lX4 = (lX & 0x40000000);
            lY4 = (lY & 0x40000000);
            lResult = (lX & 0x3FFFFFFF)+(lY & 0x3FFFFFFF);
            if (lX4 & lY4) {
                return (lResult ^ 0x80000000 ^ lX8 ^ lY8);
            }
            if (lX4 | lY4) {
                if (lResult & 0x40000000) {
                    return (lResult ^ 0xC0000000 ^ lX8 ^ lY8);
                } else {
                    return (lResult ^ 0x40000000 ^ lX8 ^ lY8);
                }
            } else {
                return (lResult ^ lX8 ^ lY8);
            }
        };

    var F = function(x,y,z) { return (x & y) | ((~x) & z); };
    var G = function(x,y,z) { return (x & z) | (y & (~z)); };
    var H = function(x,y,z) { return (x ^ y ^ z); };
    var I = function(x,y,z) { return (y ^ (x | (~z))); };

    var FF = function(a,b,c,d,x,s,ac) {
            a = AddUnsigned(a, AddUnsigned(AddUnsigned(F(b, c, d), x), ac));
            return AddUnsigned(RotateLeft(a, s), b);
        };

    var GG = function(a,b,c,d,x,s,ac) {
            a = AddUnsigned(a, AddUnsigned(AddUnsigned(G(b, c, d), x), ac));
            return AddUnsigned(RotateLeft(a, s), b);
        };

    var HH = function(a,b,c,d,x,s,ac) {
            a = AddUnsigned(a, AddUnsigned(AddUnsigned(H(b, c, d), x), ac));
            return AddUnsigned(RotateLeft(a, s), b);
        };

    var II = function(a,b,c,d,x,s,ac) {
            a = AddUnsigned(a, AddUnsigned(AddUnsigned(I(b, c, d), x), ac));
            return AddUnsigned(RotateLeft(a, s), b);
        };

    var ConvertToWordArray = function(str) {
            var lWordCount;
            var lMessageLength = str.length;
            var lNumberOfWords_temp1=lMessageLength + 8;
            var lNumberOfWords_temp2=(lNumberOfWords_temp1-(lNumberOfWords_temp1 % 64))/64;
            var lNumberOfWords = (lNumberOfWords_temp2+1)*16;
            var lWordArray=Array(lNumberOfWords-1);
            var lBytePosition = 0;
            var lByteCount = 0;
            while ( lByteCount < lMessageLength ) {
                lWordCount = (lByteCount-(lByteCount % 4))/4;
                lBytePosition = (lByteCount % 4)*8;
                lWordArray[lWordCount] = (lWordArray[lWordCount] | (str.charCodeAt(lByteCount)<<lBytePosition));
                lByteCount++;
            }
            lWordCount = (lByteCount-(lByteCount % 4))/4;
            lBytePosition = (lByteCount % 4)*8;
            lWordArray[lWordCount] = lWordArray[lWordCount] | (0x80<<lBytePosition);
            lWordArray[lNumberOfWords-2] = lMessageLength<<3;
            lWordArray[lNumberOfWords-1] = lMessageLength>>>29;
            return lWordArray;
        };

    var WordToHex = function(lValue) {
            var WordToHexValue="",WordToHexValue_temp="",lByte,lCount;
            for (lCount = 0;lCount<=3;lCount++) {
                lByte = (lValue>>>(lCount*8)) & 255;
                WordToHexValue_temp = "0" + lByte.toString(16);
                WordToHexValue = WordToHexValue + WordToHexValue_temp.substr(WordToHexValue_temp.length-2,2);
            }
            return WordToHexValue;
        };

    var x=Array();
    var k,AA,BB,CC,DD,a,b,c,d;
    var S11=7, S12=12, S13=17, S14=22;
    var S21=5, S22=9 , S23=14, S24=20;
    var S31=4, S32=11, S33=16, S34=23;
    var S41=6, S42=10, S43=15, S44=21;

    str = this.utf8_encode(str);
    x = ConvertToWordArray(str);
    a = 0x67452301; b = 0xEFCDAB89; c = 0x98BADCFE; d = 0x10325476;

    for (k=0;k<x.length;k+=16) {
        AA=a; BB=b; CC=c; DD=d;
        a=FF(a,b,c,d,x[k+0], S11,0xD76AA478);
        d=FF(d,a,b,c,x[k+1], S12,0xE8C7B756);
        c=FF(c,d,a,b,x[k+2], S13,0x242070DB);
        b=FF(b,c,d,a,x[k+3], S14,0xC1BDCEEE);
        a=FF(a,b,c,d,x[k+4], S11,0xF57C0FAF);
        d=FF(d,a,b,c,x[k+5], S12,0x4787C62A);
        c=FF(c,d,a,b,x[k+6], S13,0xA8304613);
        b=FF(b,c,d,a,x[k+7], S14,0xFD469501);
        a=FF(a,b,c,d,x[k+8], S11,0x698098D8);
        d=FF(d,a,b,c,x[k+9], S12,0x8B44F7AF);
        c=FF(c,d,a,b,x[k+10],S13,0xFFFF5BB1);
        b=FF(b,c,d,a,x[k+11],S14,0x895CD7BE);
        a=FF(a,b,c,d,x[k+12],S11,0x6B901122);
        d=FF(d,a,b,c,x[k+13],S12,0xFD987193);
        c=FF(c,d,a,b,x[k+14],S13,0xA679438E);
        b=FF(b,c,d,a,x[k+15],S14,0x49B40821);
        a=GG(a,b,c,d,x[k+1], S21,0xF61E2562);
        d=GG(d,a,b,c,x[k+6], S22,0xC040B340);
        c=GG(c,d,a,b,x[k+11],S23,0x265E5A51);
        b=GG(b,c,d,a,x[k+0], S24,0xE9B6C7AA);
        a=GG(a,b,c,d,x[k+5], S21,0xD62F105D);
        d=GG(d,a,b,c,x[k+10],S22,0x2441453);
        c=GG(c,d,a,b,x[k+15],S23,0xD8A1E681);
        b=GG(b,c,d,a,x[k+4], S24,0xE7D3FBC8);
        a=GG(a,b,c,d,x[k+9], S21,0x21E1CDE6);
        d=GG(d,a,b,c,x[k+14],S22,0xC33707D6);
        c=GG(c,d,a,b,x[k+3], S23,0xF4D50D87);
        b=GG(b,c,d,a,x[k+8], S24,0x455A14ED);
        a=GG(a,b,c,d,x[k+13],S21,0xA9E3E905);
        d=GG(d,a,b,c,x[k+2], S22,0xFCEFA3F8);
        c=GG(c,d,a,b,x[k+7], S23,0x676F02D9);
        b=GG(b,c,d,a,x[k+12],S24,0x8D2A4C8A);
        a=HH(a,b,c,d,x[k+5], S31,0xFFFA3942);
        d=HH(d,a,b,c,x[k+8], S32,0x8771F681);
        c=HH(c,d,a,b,x[k+11],S33,0x6D9D6122);
        b=HH(b,c,d,a,x[k+14],S34,0xFDE5380C);
        a=HH(a,b,c,d,x[k+1], S31,0xA4BEEA44);
        d=HH(d,a,b,c,x[k+4], S32,0x4BDECFA9);
        c=HH(c,d,a,b,x[k+7], S33,0xF6BB4B60);
        b=HH(b,c,d,a,x[k+10],S34,0xBEBFBC70);
        a=HH(a,b,c,d,x[k+13],S31,0x289B7EC6);
        d=HH(d,a,b,c,x[k+0], S32,0xEAA127FA);
        c=HH(c,d,a,b,x[k+3], S33,0xD4EF3085);
        b=HH(b,c,d,a,x[k+6], S34,0x4881D05);
        a=HH(a,b,c,d,x[k+9], S31,0xD9D4D039);
        d=HH(d,a,b,c,x[k+12],S32,0xE6DB99E5);
        c=HH(c,d,a,b,x[k+15],S33,0x1FA27CF8);
        b=HH(b,c,d,a,x[k+2], S34,0xC4AC5665);
        a=II(a,b,c,d,x[k+0], S41,0xF4292244);
        d=II(d,a,b,c,x[k+7], S42,0x432AFF97);
        c=II(c,d,a,b,x[k+14],S43,0xAB9423A7);
        b=II(b,c,d,a,x[k+5], S44,0xFC93A039);
        a=II(a,b,c,d,x[k+12],S41,0x655B59C3);
        d=II(d,a,b,c,x[k+3], S42,0x8F0CCC92);
        c=II(c,d,a,b,x[k+10],S43,0xFFEFF47D);
        b=II(b,c,d,a,x[k+1], S44,0x85845DD1);
        a=II(a,b,c,d,x[k+8], S41,0x6FA87E4F);
        d=II(d,a,b,c,x[k+15],S42,0xFE2CE6E0);
        c=II(c,d,a,b,x[k+6], S43,0xA3014314);
        b=II(b,c,d,a,x[k+13],S44,0x4E0811A1);
        a=II(a,b,c,d,x[k+4], S41,0xF7537E82);
        d=II(d,a,b,c,x[k+11],S42,0xBD3AF235);
        c=II(c,d,a,b,x[k+2], S43,0x2AD7D2BB);
        b=II(b,c,d,a,x[k+9], S44,0xEB86D391);
        a=AddUnsigned(a,AA);
        b=AddUnsigned(b,BB);
        c=AddUnsigned(c,CC);
        d=AddUnsigned(d,DD);
    }

    var temp = WordToHex(a)+WordToHex(b)+WordToHex(c)+WordToHex(d);

    return temp.toLowerCase();
}

Hmm, same copy/paste as the other answer. So certainly one of you didn't write it - please supply proper attribution. — Michael Berkowski, Jan 02 '13 at 21:26
@PavelVlasov Fixed. I have added utf8_encode function. I have eddited my previous answer — user1279525, Apr 17 '19 at 09:41
getting an error on chrome: Uncaught TypeError: this.utf8_encode is not a function — Rob, Aug 06 '20 at 02:00

Siamak Motlagh · Answer 2 · 2020-08-14T06:37:06.990

4

You can use this function: Follow the link:
MD5 function in javascript

edited Aug 14 '20 at 06:37

answered Jan 02 '13 at 21:22

Siamak Motlagh

5,028
7
41
65

3

Unless you wrote this whole library yourself, please attach an attribution for the original source. – Michael Berkowski Jan 02 '13 at 21:23
better than the Nikita Platonenko answer because there are no ut8 errors. thank you – Rob Aug 06 '20 at 02:22

mekwall · Answer 3 · 2013-01-02T21:34:02.810

Short answer: Nope.

Long answer: Passwords should never be sent over an unencrypted channel, hashed or not. It's just not secure enough. You should look at implementing login over SSL/TLS instead.

Another solution is to implement login using a third-party, such as Facebook, Github, Google or other OAuth provider.

But if you have no choice, a hashed password is better than sending it in clear text. If so I recommend using the crypto-js md5 implementation.

score -1 · Answer 4 · answered Jun 10 '20 at 15:19

The purpose of hashing the password before verifying is: you store only the hash of the password on your server; when someone gives you a password, you hash it and compare that hashed value against the hash you previously saved. If the password is was valid, the hashes will match. Using this method you get two benefits:

You don't store the user's password so it's safer for the users. The password is plain text until it is hashed on the server side, but it's safe if you have in-transit encryption and your servers aren't compromised.
If someone steals your list of hashes they will still not be able to login because they don't know the actual passwords that generate those hashes (unless it can be easily looked up in rainbow tables).

If your user-interface is sending only the hash to the server, you completely negate the second benefit since anyone who knows the hashes can pretend to be anyone else by just giving the hash to you. If you are concerned about sending plain-text password from client to server because you don't have in-transit encryption, then you are even worse off because the everyone can see the hashed password that you're sending, and send that same hashed password to your server to pretend to be that login.

As for the MD5 function in Javascript, there's CryptoJS library which works well, already mentioned in StackOverflow: fastest MD5 Implementation in JavaScript

Is there any built-in function to generate MD5 of string in JavaScript/jQuery?

4 Answers4