MD5 Hash Generator_
The MD5 digest of any text or file, computed here and checked against the seven test vectors printed in RFC 1321 — the specification's own examples, so an error anywhere in the implementation would fail the build rather than reach you.
MD5 is broken, and the useful question is how. Its collision resistance collapsed in 2004 and is now a few seconds of work; its preimage resistance has never fallen. That distinction is not pedantry — it is precisely what decides whether your particular use of MD5 is fine or indefensible, and the section below draws the line.
—Producing a digest of a password? Do not. MD5 is fast and unsalted, which makes a stolen table of MD5 passwords a dictionary exercise. Password storage wants bcrypt, scrypt or Argon2.
- Input
- Text, hashed as its UTF-8 bytes, or any local file hashed from its raw bytes. A file is read in the page; choosing one does not upload it.
- Output
- Thirty-two hexadecimal characters, lowercase by default. Uppercase is the same digest written differently and verifies identically.
- Processing
- Computed in this tab from an implementation written against RFC 1321. Web Crypto does not offer MD5 — deliberately, because it is broken — which is why it is written out here rather than borrowed from the platform.
- Limits
- No salt, no key, no iteration count. This is a bare digest, which is what a checksum is and what a stored password must never be.
- Collision broken, preimage not
- Two different inputs can be made to share an MD5 in seconds on a laptop — that is a collision, and it destroys MD5 for signatures, certificates and anything where an adversary supplies the content. Going from a digest back to an input is a preimage attack, and no practical one exists. So MD5 fails wherever somebody chooses what gets hashed, and holds wherever you are only checking that bytes survived a copy.
Broken in one specific way, and it decides everything
Collisions are cheap; preimages are not
There are two ways to break a hash and MD5 has only lost one of them. A collision is two different inputs sharing a digest — Wang's attack made that practical in 2004, and the cost has since fallen to seconds on ordinary hardware. A preimage is starting from a digest and finding an input that produces it, and after two decades of attention nobody has a practical method. The consequence is sharp: MD5 fails completely when an attacker gets to choose what is hashed, and is untouched when you are simply asking whether two copies of a file are the same.
Where that leaves MD5 in real systems
It survives, legitimately, in a surprising number of places. An HTTP ETag is often an MD5 of the response body, and a cache does not have an adversary. Storage systems use it to spot duplicate blocks. Gravatar addresses you by the MD5 of your email. Build tools use it as a cache key. Every one of those is asking "are these bytes the same bytes", nobody is trying to forge anything, and a faster hash is a genuine advantage. Replacing MD5 in those places buys nothing.
And where it is indefensible
Anywhere the input is chosen by someone who benefits from a collision. Code signing, certificate signing, tamper-evident logs, licence files, document integrity in a dispute — in all of those an attacker can prepare two files with one digest, get the harmless one approved, and substitute the other. This is not theoretical: colliding executables and colliding PDFs have both been published, and the Flame malware forged a Microsoft code-signing certificate through an MD5 collision in 2012.
The page-one result that is simply wrong
Searching for this tool returns, among the first twenty results, an "MD5 Password Generator" and two pages offering to "encrypt" and "decrypt" MD5. Neither framing survives contact with what MD5 is. It is not encryption — there is no key and nothing to decrypt — and it is the wrong function for a password precisely because it is fast: a stolen table of unsalted MD5 password digests is a dictionary exercise, which is why bcrypt, scrypt and Argon2 are deliberately slow and salt each entry separately.
Computing the same digest elsewhere
md5sum file on Linux, md5 file on macOS, and Get-FileHash -Algorithm MD5 file in PowerShell all produce what this page produces. In Python it is hashlib.md5(data).hexdigest(), where data must be bytes rather than a string; in PHP, md5($string); in Node, crypto.createHash('md5'). If your result differs from one of those, the input differs — a trailing newline is the usual culprit, and md5sum hashes the file exactly as it is on disk.
Type it, or check a download against its checksum
- 01Type or paste text — the digest recomputes on every keystroke, with nothing submitted anywhere.
- 02For a download, choose the file rather than typing anything: a checksum describes the bytes on disk, and no amount of retyping the filename will reproduce them.
- 03Paste a published checksum into the verify box to compare. It is case-insensitive, because the same digest gets printed both ways.
- 04Switch the output to uppercase if that is how your source prints it — the comparison above ignores case either way, so this is only about reading the two side by side.
Verifying a download that publishes an MD5
Plenty of mirrors and older projects still list MD5 beside the file. For catching a truncated or corrupted transfer it is entirely adequate — a network error does not construct collisions.
d41d8cd98f00b204e9800998ecf8427e
Same 32 characters → the bytes arrived intact. Different → download it again.
Finding duplicate files
Two files with the same MD5 are, in the absence of anybody attacking you, the same file. This is how deduplication and build caches work, and why they still use it.
9e107d9d372bb6826bd81d3542a419d6
9e107d9d372bb6826bd81d3542a419d6 Identical contents. Delete one.
A Gravatar URL
Gravatar identifies an account by the MD5 of its lowercased, trimmed email address. It is an identifier rather than a secret, which is the only reason a fast hash is acceptable here.
someone@example.com
gravatar.com/avatar/ 6b2b0c4b3d1e6ad0f4a2c4dd7c2f0a9c
What you must not do with it
Storing a password as a bare MD5 puts every common password in the database within reach of a lookup table that already exists.
md5("hunter2") = 2ab96390c7dbe3439de74d0c9b0b1767bcrypt, scrypt or Argon2 — salted per user, and slow on purpose.
What survives MD5 being broken, and what does not
| Use | Verdict | Reason |
|---|---|---|
| Checking a download transferred correctly | Fine | A transmission error is not an adversary and will not produce a collision. |
| Finding duplicate files or blocks | Fine | Nobody is crafting inputs; you are asking whether two things are the same. |
| Cache keys and HTTP ETags | Fine | The digest identifies content to your own system. Speed is a genuine advantage. |
| Gravatar and similar identifiers | Fine | An identifier, not a secret. The email is not protected by it and never was. |
| Storing passwords | Never | Fast and unsalted. Use bcrypt, scrypt or Argon2, which are slow and salted by design. |
| Code or certificate signing | Never | The attacker chooses the input. Forged certificates via MD5 collision are documented, not hypothetical. |
| Tamper-evident logs or licences | Never | Anything an adversary may want to substitute needs collision resistance MD5 no longer has. |
| Deduplicating untrusted uploads | Careful | A user who controls both files can make them collide, so one can shadow the other. |
The dividing line in every row is the same question: does somebody who benefits from a collision get to choose what is hashed? If yes, MD5 is out. If no, it is still a fast and perfectly serviceable fingerprint.
Working with MD5 without getting caught out
- Ask who chooses the input. That single question sorts every use of MD5 into fine and forbidden more reliably than any rule of thumb.
- Prefer SHA-256 for anything new. MD5 is worth keeping where it already works and is not worth introducing.
- Treat a digest as one opaque token. Comparing the first eight characters is a habit that works until the day two files share a prefix, and then fails silently.
- If your digest disagrees with
md5sum, check for a trailing newline. Hashing a string and hashing a file containing that string are different inputs. - Never reach for MD5 because it is short. A 32-character identifier is not a reason to accept a broken hash where a 64-character one would do.
The claims made about MD5 that are not true
MD5 is not encryption
Tools offering to "encrypt" or "decrypt" MD5 are describing something that does not exist. There is no key. Sites that appear to reverse it are searching precomputed tables of common inputs.
"Broken" does not mean "reversible"
MD5 lost collision resistance, not preimage resistance. You cannot recover an input from a digest, which is why the same page that warns MD5 is broken also cannot decrypt one for you.
Salting does not rescue MD5 for passwords
A salt defeats precomputed tables and does nothing about speed. Hardware computes MD5 at billions of digests per second, so a salted MD5 still falls to a targeted attack far faster than bcrypt would.
A matching MD5 proves the bytes, not the source
It tells you the file matches what was hashed. If whoever alters the file also controls the page publishing the checksum, nothing has been verified — that is what signatures are for.
Algorithm, verification and encoding
- Algorithm
- MD5 as specified in RFC 1321. Four rounds of sixty-four operations over 512-bit blocks, producing a 128-bit digest written as thirty-two hexadecimal characters.
- Verified against
- All seven test vectors printed in RFC 1321, plus inputs at 55, 56, 57, 63, 64 and 65 bytes — the padding boundaries where an implementation can be wrong for every longer message while looking correct on short ones.
- Why not Web Crypto
- The browser does not offer MD5, and that omission is deliberate on the platform's part. The implementation here exists because the checksum use is legitimate, not because the omission was an oversight.
- Input encoding
- Text becomes UTF-8 before hashing, which is why the digest of an accented word differs from what a Latin-1 system would produce for the same letters. Files are hashed exactly as they sit on disk, newline included.
- File handling
- Uploads are read inside the page with the browser File API and are never transmitted; Download writes out what is already in the tab.
- Network
- None from tool code. A test sweep calls every function this page uses with
fetchandXMLHttpRequestreplaced by stubs that throw, so a stray request fails the build instead of shipping. Disconnect from the network and the page still works.
Questions about MD5
Is MD5 still safe to use in 2026?
It depends entirely on whether an attacker chooses what gets hashed. For verifying a download transferred correctly, spotting duplicate files, or generating a cache key, it is fine and always has been. For signing, for anything tamper-evident, and for passwords, it is indefensible — collisions cost seconds.
What is an MD5 collision?
Two different inputs that produce the same digest. Making one deliberately became practical in 2004 and now takes seconds. It matters because an attacker can prepare a harmless file and a malicious one sharing a digest, get the first approved, and swap in the second.
Can MD5 be decrypted or reversed?
No. MD5 is not encryption and has no key, and its preimage resistance — going from digest back to input — has never been broken. Sites that appear to reverse it are looking the digest up in a table of digests they computed earlier from common strings.
Why is MD5 called broken if it cannot be reversed?
Because a hash has two properties and MD5 has lost one. Collision resistance is gone; preimage resistance is intact. "Broken" in the literature means the first, which is exactly why the same algorithm can be unusable for signatures and perfectly adequate for checksums.
Can I use MD5 for passwords if I salt it?
No. Salting stops precomputed tables and does nothing about speed, and speed is the problem — commodity hardware computes billions of MD5 digests a second. Password hashing needs a function that is slow on purpose: bcrypt, scrypt or Argon2.
How long is an MD5 hash?
Always 128 bits, printed as thirty-two hexadecimal characters, whatever the size of the input — a single letter and a gigabyte both come out at thirty-two. If the digest in front of you is longer than that, it came from a different algorithm, and the hash generator will tell you which.
Why does my MD5 differ from md5sum?
Almost always a different input rather than a different algorithm. Hashing the text "hello" and hashing a file containing "hello" plus a trailing newline are two different inputs, and md5sum reads the file exactly as it sits on disk. Check the byte count first.
How do I compute an MD5 in Python or PHP?
hashlib.md5(data).hexdigest() in Python, where data must be bytes — encode a string first or it raises. md5($string) in PHP. In Node, crypto.createHash('md5').update(data).digest('hex'). All three produce exactly what this page produces for the same bytes.
Is my text or file uploaded?
No. The work is JavaScript running in this tab. Every function it calls is covered by a test that stubs fetch and XMLHttpRequest to throw, so a request that slipped in would break the build rather than reach a server — and you can confirm it for yourself by disconnecting and carrying on.