MD5 hash generator

Text hashed as UTF-8

Or drop a file here, or click to choose one. Files of any size work.

OutputHexBase64Base64url

Uppercase hex

Nothing you type or drop here leaves your browser. Files are read in 4 MB pieces by a background worker.

This MD5 hash generator computes the MD5 digest of text or a file right in your browser, and nothing is sent anywhere. MD5 gives 128 bits, shown as 32 hexadecimal characters. It's broken for security. It still works for checking that a file wasn't accidentally damaged, but never use it where someone might tamper with the data on purpose.

A short history of a dying hash

Ronald Rivest designed MD5 in 1991 as the successor to MD4, and RFC 1321 published it in April 1992. It reads input in 64-byte blocks and mixes each into a 128-bit state through four rounds of sixteen steps. For about a decade it was the standard fingerprint, used for file checksums, certificate signatures and password storage. What followed is one of the best lessons in how a hash ages.

• 1996: Hans Dobbertin found a collision in MD5's compression function. It was a warning, not yet a break of the full hash.
• August 2004: Xiaoyun Wang, Dengguo Feng, Xuejia Lai and Hongbo Yu announced collisions for the full MD5. Finding one has since become so cheap that it takes seconds to minutes on an ordinary computer.
• December 2008: researchers used MD5 collisions to build a rogue intermediate certificate authority certificate, which would have let them impersonate any website. The CMU Software Engineering Institute's advisory said MD5 was "cryptographically broken and unsuitable for further use".
• 2012: Microsoft reported that the authors of the Flame malware had forged a Windows code-signing certificate using an MD5 collision.

All of these are collision attacks. Someone who gets to choose both messages can make two that share a fingerprint. Finding a message for a given MD5 digest (a preimage) still isn't feasible that way, but the weaker property is enough to forge signed documents and certificates, and that's why standards stopped accepting MD5. The general idea is in what a hash function is.

Known values

Fine for some jobs, wrong for others

MD5 is fine for catching accidental corruption. A flipped bit or a truncated download changes an MD5 as surely as it changes any hash, and plenty of old software distributions still publish MD5 sums for that reason. It also works for finding duplicate files, or as a cache key in your own system, where nobody's trying to fool you. And some older protocols and file formats simply call for it.

It's wrong for anything an attacker could gain by changing. That covers a download from a mirror you don't trust, a signed document and a certificate. Use SHA-256 (SHA-256 hash generator) or better there. It's also wrong for passwords. MD5 isn't just broken, it's extremely fast. One graphics card can test billions of guesses a second, and unsalted MD5 hashes of common passwords can simply be looked up in published tables. Use a slow, salted function (password hashing).

Compute it from the command line

The file checksum tool verifies a file against an MD5 sum. The hash identifier will tell you a 32-character hex string might be MD5, or another 128-bit hash such as NTLM.

Common questions