Converts a string into a fixed length hexadecimal string.

NOTE: The result is useful for comparison and validation, such as storing and validating a hashed password without exposing the original password.

hash(string [, algorithm [, encoding]] [, additionalIterations]) → returns string

Argument Reference

string string

algorithm string
Default: MD5

CF 7+ A supported algorithm such as MD5,SHA,SHA-256,SHA-384, or SHA-512. Of those listed SHA-512 is the strongest and generates a 128 character hex result.

NOTE: The Enterprise Edition of ColdFusion installs the RSA BSafe Crypto-J library, which provides FIPS-140 Compliant Strong Cryptography. This includes additional algorithms. You can also install additional cryptography algorithms and use those hashing algorithms.
  • MD5
  • SHA
  • SHA-256
  • SHA-384
  • SHA-512

encoding string
Default: UTF-8

CF 7+ A string specifying the encoding to use when converting the string to byte data used by the hash algorithm.
Must be a character encoding name recognized by the Java runtime.

NOTE: The default is specified by the value of defaultCharset in the neo-runtime.xml file, which is normally UTF-8.
NOTE: This is ignored when using the CFMX_COMPAT algorithm.
  • utf-8
  • iso-8859-1
  • windows-1252
  • us-ascii
  • shift_jis
  • iso-2022-jp
  • euc-jp
  • euc-kr
  • big5
  • euc-cn
  • utf-16

additionalIterations numeric
Default: 0

CF 10+ Iterates the number of times the hash is computed to create a more computationally intensive hash. Lucee and Adobe CF implement this differently (off by one), see compatibility notes below.

NOTE: This parameter appears to be ignored if the CFMX_COMPAT default algorithm is used.



Version 4.5+ CF7 added additional algorithm support, CF10 added the iterations option. CF2018 uses additionalIterations as the iterations param.


The iterations value represents the total number of hashes on Lucee, in Adobe CF the value is the number of additional iterations. In Lucee5+, the iterations param is numIterations.

Links more information about hash

Sample code invoking the hash function

Returns 64 character hex result.

hash("something", "SHA-256", "UTF-8")

Expected Result: 3FC9B689459D738F8C88A3A48AA9E33542016B7A4052E001AAA536FCA74813CB

MD5 is not recommended for use requiring security.


Expected Result: 437B930DB84B8079C2DD804A71936B5F

Signup for cfbreak to stay updated on the latest news from the ColdFusion / CFML community. One email, every friday.

Fork me on GitHub