Hexadecimal in Cryptographic Output

Hexadecimal (hex) is a base-16 numbering system using the digits 0-9 and letters A-F (or a-f). Each hex digit represents exactly 4 bits (a nibble), since 16 = 2^4.

Hex is the universal language of binary data in computing. Memory addresses, byte values, color codes, and cryptographic outputs are all commonly expressed in hexadecimal.

Because each hex digit represents exactly 4 bits, every byte (8 bits) maps to exactly 2 hex digits. This makes conversion between binary and hex trivial: split binary into 4-bit groups and convert each group.

For example, the byte 11001010 splits into 1100 (C) and 1010 (A), giving the hex value CA. No arithmetic is needed, just lookup table conversion.

To convert binary to hex, group the bits in fours from right to left, then convert each group: 0000=0, 0001=1, ..., 1001=9, 1010=A, 1011=B, 1100=C, 1101=D, 1110=E, 1111=F.

Example: 11111111 becomes 1111|1111 = FF = 255 decimal. 00000000 becomes 00 = 0 decimal. 01001000 = 0100|1000 = 48 = the ASCII code for 'H'.

A full 32-byte key (256 bits) would require 256 ones and zeros in binary. In hex, it is just 64 characters. In decimal, it would be a number up to 78 digits long.

Hex strikes the right balance: compact enough to be readable and writable by humans, while directly representing the underlying binary structure without any conversion overhead.

SHA-256 produces a 256-bit (32-byte) hash. When displayed in hex, this is always exactly 64 hexadecimal characters. For example, the SHA-256 hash of "hello" is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.

Counting: 64 hex characters × 4 bits = 256 bits. The fixed length is a fundamental property of hash functions, regardless of input size.

Cryptographic keys are typically stored and displayed as hex strings. An AES-128 key is 16 bytes = 32 hex characters. An AES-256 key is 32 bytes = 64 hex characters.

When configuring TLS or encrypting files, you often need to provide keys as hex strings. Tools like OpenSSL, the Python cryptography library, and most crypto frameworks expect and produce hex-encoded keys.

Initialization Vectors (IVs) and nonces are also represented in hex. A standard AES-CBC IV is 16 bytes = 32 hex characters. AES-GCM typically uses a 12-byte nonce = 24 hex characters.

Hex notation makes it easy to visually inspect and compare IVs, verify that two messages used different nonces, and manually debug cryptographic protocols during development.

OpenSSL outputs hashes and keys in a specific format: lowercase hex with colons between each byte pair. For example, an MD5 hash appears as "b9:4d:27:b9:93:4d:3e:08:a5:2e:52:d7:da:7d:ab:fa:c4:84:ef:e8".

The colon-separated format makes each byte visually distinct and easier to compare. Different tools may output hex without colons or with uppercase letters, but the underlying bytes are identical.

X.509 certificates are stored in DER format (binary) or PEM format (Base64-encoded DER). Hex would work too, but Base64 is 33% more compact than hex (each Base64 character encodes 6 bits vs hex's 4 bits).

For large objects like certificates and encrypted files, Base64 is preferred. For short values like hashes, keys, IVs, and MACs, hex is preferred because it directly shows byte boundaries.

A hex dump shows a file or memory region as both hex bytes and ASCII characters side by side. The left column shows hex, the right shows printable ASCII (with dots for non-printable bytes).

Reading hex dumps is an essential skill for cryptographic debugging. Verifying that an IV starts at the correct offset, that a key has the right length, or that a ciphertext prefix matches expectations all require reading hex dumps.

HTTP security headers and cryptographic tokens frequently use hex encoding. CSRF tokens, session identifiers, and API keys are often represented as hex strings of 32-64 characters.

A 128-bit (16-byte) random CSRF token encoded as hex is 32 characters. This is easily verifiable for correctness: count the characters, check only 0-9 and a-f appear, and ensure no padding characters which would indicate Base64 instead of hex.

Test your understanding of hexadecimal representation.

Hexadecimal encodes 4 bits per character, making 1 byte = 2 hex digits. SHA-256 produces 64 hex chars (256 bits), AES-128 keys are 32 hex chars, AES-256 keys are 64 hex chars.

Hex is the standard representation for cryptographic hashes, keys, IVs, and nonces because it directly reflects byte structure. OpenSSL and most crypto tools output and accept hex-encoded values.