MD5 Hash Generator

About MD5 Generator

An MD5 digest of whatever you paste, in hex or Base64, with a straight answer about what it is worth. MD5 is still everywhere — package manifests, older APIs, database columns, ETags — and matching one of those is a perfectly good reason to compute it.

What it is not is a security primitive. Two different inputs can be made to share an MD5 in seconds on a laptop, and chosen-prefix collisions — where an attacker picks both files in advance — take hours. Certificates and malware have been forged on the strength of that, so a signature, a password or an integrity check over MD5 protects nobody.

The grade and the effort figures shown alongside say the same thing in numbers: about 2^18 work for a collision, against 2^128 for SHA-256. Reversing a digest is still hard, so MD5 is not 'decryptable' — but a common password is found instantly by looking it up in a table someone else has already built.

Paste a digest into *Compare with* to check one you were given, and use the Hash Generator when you need an algorithm that is still trusted.

Where it helps

• Computes the digest the older systems, manifests and APIs still ask for.
• Hex in either case and Base64, with a comparison against a digest you were given.
• States what an attack actually costs rather than leaving 'insecure' as an adjective.
• Runs in the browser, so whatever you are hashing stays on your machine.

Limits

• MD5 is broken for every security purpose: collisions are cheap and have been used in real attacks.
• It says nothing about whether a file came from who you think it did — only that two things are byte-identical.
• A digest of a short or common string can be reversed by lookup, so it hides nothing.
• Text only: hash a file with the File Checksum tool, which reads the bytes rather than a transcription of them.

Frequently asked questions

Is MD5 safe to use?

For catching accidental corruption, yes. For anything an attacker would want to forge — signatures, passwords, integrity checks, deduplication that matters — no. Use SHA-256 or BLAKE3.

Can an MD5 hash be decrypted?

No, because it is not encryption: nothing was encrypted and there is no key. What can happen is a lookup — if the input was a common password, someone has already published its digest.

Why does my MD5 differ from another tool's?

Usually the input differs: a trailing newline, a different line ending, or a file being hashed rather than the text inside it. This hashes exactly the characters you paste, as UTF-8.

What should I use instead?

SHA-256 for compatibility and BLAKE3 for speed. Both are in the Hash Generator, along with SHA-3 and the BLAKE2 family.

Related tools

• Hash Generator — SHA-2, SHA-3, BLAKE and legacy digests, in any encoding
• File Checksum — Verify a download, and work out which algorithm made the checksum
• HMAC Generator — Keyed message authentication codes
• Key Derivation — Stretch a passphrase into key material with PBKDF2, scrypt or Argon2id
• Password Generator — Strong random passwords with an entropy estimate
• Password Strength — Judge a password by what an attacker would actually try

More Security & Cryptography tools

• Hash Generator — SHA-2, SHA-3, BLAKE and legacy digests, in any encoding
• HMAC Generator — Keyed message authentication codes
• Key Derivation — Stretch a passphrase into key material with PBKDF2, scrypt or Argon2id
• Password Generator — Strong random passwords with an entropy estimate
• Password Strength — Judge a password by what an attacker would actually try
• JWK Generator — A JSON Web Key for a JOSE algorithm, with its key set and thumbprint id
• Key Pair Generator — RSA and elliptic-curve key pairs, generated in this tab and never sent
• TOTP / HOTP Generator — Two-factor codes, the QR code to enrol with, and why one did not match
• Text Encryption — AES-256-GCM with a PBKDF2 passphrase
• Bcrypt Generator — Hash a password with bcrypt, verify one against a hash, or read what a hash is made of