# What is the probability that an MD5 hash will form a number in scientific notation?

This was a really crazy bug @bdeshong & @jpcorry found. Randomly, the system generated an MD5 hash that looked like scientific notation.

MD5 hashes are 32 characters in hexadecimal (base-16, 0-9 A-F). Scientific notation is recognized in PHP as one or more decimal digits, followed by E, followed by one or more decimal digits.

"1E234" is numeric
"E1234" is not numeric
"1234E" is not numeric


What would be the probability of randomly generating an MD5 hash of this kind?

• would "04E02" be an MD_5 HASH? Nov 3 '17 at 16:22
• would 0E000 be a valid hash? Nov 3 '17 at 16:22
• @JorgeFernández Yes, those are both valid. Nov 3 '17 at 16:23
• Is this just a thought experiment for fun or is it a real requirement? Specific platforms may impose stricter limits e.g. 1E123456789012345678901234567890 has the right syntax but is probably beyond the valid range of most platforms. Also, is the string 32 characters or less or exactly 32 characters? Nov 3 '17 at 17:18
• @badjohn Just a thought experiment inspired by a tweet, no actual software affected here. MD5 strings are always exactly 32 characters long. Nov 3 '17 at 19:40

You're looking for the probability that a string of 32 characters in $\{0, 1, \ldots, 9, A, B, \ldots F \}$, chosen uniformly at random, has all its characters are numeric (0 to 9), except for one character which is $E$, which is not the first or last character.

There are of course $16^{32}$ total possible hashes.

To construct a hash which looks like a number in scientific notation, first pick where the $E$ goes. There are $32 - 2 = 30$ ways to do this. Then fill in the remaining 31 characters with digits, which can be done in $10^{31}$ ways.

So the probability you're looking for is

$${30 \times 10^{31} \over 16^{32}} \approx 8.8 \times 10^{-7}.$$

• the number on the right can be in HEXA I think Nov 3 '17 at 16:35
• @JorgeFernández, As far as I understand, $a$E$b$ simply refers to $a \times 10^b$, and we only allow decimals for both $a$ and $b$. A subtle issue is whether we allow decimals beginning $0$ or not, but this has no significant effect on the magnitude of the probability. Nov 3 '17 at 16:38
• Oh, I got confused. I thought the number after $E$ could be a number in hexadecimal :( yeah, with the correct reading this solution seems ok. Nov 3 '17 at 16:39
• If we don't allow decimals beginning with $0$ we can just multiply by $(9/10)^2$. There are two places that we might not allow a $0$, the first digit and the digit immediately following $E$. Although perhaps $E0$ should be allowed and not, say, $E01$? But in any case, the magnitude of the answer doesn't depend on this condition. Nov 3 '17 at 16:42