MD5 Hash Generator

MD5 is a cryptographic hash function published in 1991, producing a 128-bit (32-hex-character) digest. The tool above computes MD5 in your browser; the input never leaves your machine.

Status: broken for security

MD5 is broken for any use that depends on collision resistance:

• Researchers published practical collision attacks in 2004.
• A 2008 attack constructed a fake CA certificate using MD5 collisions.
• A 2012 malware (Flame) exploited MD5 collisions to forge Microsoft signatures.
• Today, generating an MD5 collision takes seconds on a laptop.

“Broken” here means specifically: an attacker can craft two different inputs that produce the same MD5 digest. The hash is not reversible — given a digest, you still can’t recover the input. So MD5 is useless for code-signing, certificate fingerprints, and integrity-against-adversary use cases, but not useless for everything.

What MD5 is still fine for

• Accidental corruption detection. MD5 catches bit flips, partial downloads, and storage errors with the same reliability as any other hash. An attacker doesn’t get to choose the corruption.
• Cache keys / ETags. Hashing content to produce a cache key. The hash uniqueness doesn’t matter if it’s wrong; cache misses just produce a regeneration. No adversarial input.
• Deduplication keys. Same as cache keys — collisions cause false dedup but not security issues, and natural collisions are still rare.
• Legacy systems that can’t be upgraded. Some installed software requires MD5 for compatibility. Use MD5 if the system requires it; switch to SHA-256 when possible.
• Database row hashes for change detection. Adversarial collisions don’t matter; the question is “did the row change.”

The dividing line: if the hash needs to resist an attacker who chooses inputs, don’t use MD5. Otherwise, it’s fine.

A worked example

Input:    "hello"
MD5 hex:  5d41402abc4b2a76b9719d911017c592

Input:    "Hello"   (case differs by one bit)
MD5 hex:  8b1a9953c4611296a827abf8c47804d7

Avalanche — a one-bit input change scrambles the entire output. Standard hash behavior.

MD5 vs other algorithms

For new code, SHA-256 is the right default. MD5’s 128-bit output is also smaller than modern alternatives’ — relevant for storage but not a strong reason to use MD5 over a truncated SHA-256.

For storing strings as cache keys where MD5 would work, the speed advantage is small enough that you might as well use SHA-256 and not have the “is this MD5 use OK?” conversation in code review.

What MD5 isn’t

• Not encryption. No inverse exists. “Encrypting passwords with MD5” is a misnomer and a serious mistake.
• Not safe for password storage. MD5 is fast — billions of guesses per second on a GPU. Even with salt, MD5 password hashes fall to dictionary attacks in minutes. Use bcrypt, scrypt, or Argon2.
• Not a substitute for HMAC. A keyed hash (HMAC-SHA-256) authenticates a message; bare MD5 doesn’t.

Common pitfalls

• Using MD5 in new code that needs collision resistance. Even if the threat model seems low, the cost of switching to SHA-256 is small and the upside is real. Code review will flag MD5 in a security context.
• Trusting MD5 in software-distribution checksums. A determined attacker can replace a binary and forge an MD5 collision. Hashes for distribution should be SHA-256 or stronger. Verify what the publisher posted; if it’s MD5, ask for SHA-256 if available.
• Confusing MD5 with bcrypt-MD5 or PBKDF2-MD5. These are deliberately-slow constructions on top of MD5 — somewhat better than bare MD5 for passwords but still not best-practice. Replace with Argon2 / bcrypt / scrypt.
• Comparing MD5 hashes loosely. Compare the full 32 hex characters. Even partial-prefix matches are unreliable for adversarial inputs (collision construction can match any prefix you target).
• Hashing without normalization. "hello" and "Hello" and "hello\n" produce different digests. Normalize the input if semantically-equivalent inputs should hash the same.

For better algorithms, see SHA-256, SHA-512. For the multi-algorithm tool, see hash generator. For verifying file checksums, file hash.