Recently, I was implementing a class in Java that would store a hashed representation of a clear-text string using java.security.MessageDigest. This will ultimately find its way into some sort of j2ee container, but the code can obviously be tested outside of a container.

What I have noticed is that when I run a simple stand-alone test I get one result for the hash of a given string, and if I run another simple test which actually runs within a container (ie. Spring) I see a different result. The two answers do not change, but they also do not ever equal eachother.

Has anyone experience with MessageDigest? One guess is that the variation is due to the two instances using different implementations of java.security.MessageDigest, but I thought a standard was meant to avoid this problem. The other theory is a sort of optional "seed" parameter that goes into the initialization but defaults differently in the two cases.

In either case, my goodness could this cause problems when switching containers when a preexisting set of persistent data was hashed with one implementation, and now does not agree with new hashes.

Before someone points out the obvious, these are both using the same digest algorithm. The class code is left untouched between the two tests.