MD5 Hash Generator
Generate the MD5 hash of any text or file in your browser — hex or Base64 — and compare it with an expected checksum. For checksums only, not security.
How to use this tool
Steps for using the Hash Generator.
- Type or paste text, or choose File to hash a file of up to 50 MB. MD5 is listed first; the other algorithms are shown below it for comparison.
- The digest updates as you type. Pick hex, HEX (uppercase) or Base64 to match the format you need.
- Click Copy next to MD5, or Copy all / Download for every digest.
- To check a download, paste its published checksum into Verify a checksum — the matching algorithm lights up green.
Example
MD5 of the classic test sentence
The quick brown fox jumps over the lazy dog9e107d9d372bb6826bd81d3542a419d6Common use cases
- Checking a download against an MD5 checksum published by an older mirror.
- Matching values stored by a legacy database or API that uses MD5.
- Detecting duplicate files you created yourself.
- Generating short, non-secret cache keys.
What MD5 is still good for
MD5 turns any input into a 128-bit digest, written as 32 hexadecimal characters. It was designed in 1991 (RFC 1321) and is still everywhere: package mirrors, database checksums, cache keys and ETags often use it because it is fast and short.
MD5 is broken for security. Different inputs with the same MD5 can be produced in seconds on an ordinary computer, so an attacker can swap a file for a malicious one with the same checksum. Never use MD5 for passwords, signatures, certificates or anything an attacker can influence.
It is still fine for non-adversarial jobs: spotting accidental corruption, de-duplicating your own files or matching a legacy system that expects MD5. For anything new, use SHA-256.
The Web Crypto API deliberately leaves MD5 out, so this page computes it with its own implementation of RFC 1321, entirely in your browser. The empty string hashes to d41d8cd98f00b204e9800998ecf8427e — a handy value to recognise in logs.
Limitations
- Not collision-resistant: never use MD5 where an attacker could choose the input.
- Not a password hash — use a slow algorithm such as bcrypt or Argon2 on the server.
- Files up to 50 MB.
Frequently asked questions
Is MD5 secure?
No. MD5 collisions can be created in seconds, so it must not be used for signatures, certificates or passwords. It is still acceptable as a checksum against accidental corruption.
Can an MD5 hash be decrypted?
No — a hash is one-way, not encryption. But short or common inputs can be found by looking them up in precomputed tables, which is one more reason not to use MD5 for passwords.
Why is my MD5 different from another tool's?
The bytes differ: a trailing newline, Windows line endings (CRLF) or a different text encoding all change the hash. This page hashes exactly the UTF-8 text you type, with no newline added.
How long is an MD5 hash?
128 bits — 32 hexadecimal characters, or 24 characters in Base64 (including == padding).