TL;DR: MD5 is a 128-bit cryptographic hash function that turns any input into a fixed 32-character string. It is fast and still useful for checksums and file integrity, but collision attacks broke it in 2004, so it must not be used for passwords or anything security-critical.
Every developer hits MD5 at some point: a checksum on a download page, a duplicate-file detector, an old database of hashed passwords. This explainer covers what the algorithm does, why security people call it broken, and where it still works fine.
What is MD5?
MD5 (Message-Digest Algorithm 5) is a hash function designed by Ronald Rivest in 1991 and published as RFC 1321 in 1992. A hash function maps input data of any size to a fixed-size output. MD5 always produces a 128-bit result, written as a 32-character hexadecimal string such as d41d8cd98f00b204e9800998ecf8427e.
Hash functions have three properties that matter here:
- Deterministic: the same input always gives the same hash.
- Fast: hashing large data takes milliseconds.
- One-way: you cannot recover the input from the hash.
How does MD5 work?
MD5 processes input in 512-bit blocks. It pads the data to a multiple of 512 bits, appends the original message length, and then runs four rounds of compression that mix each block with internal state. Each block updates a 128-bit state variable, and the final state is the hash.
You do not need the internal math to use MD5. What matters is the behavior: changing a single bit in the input changes roughly half the output bits, so two different inputs with the same hash are essentially impossible to find by accident.
What is an MD5 hash used for?
MD5 appears in roles that do not need its security:
- File integrity: a download page lists an MD5 checksum, you hash the downloaded file and compare. Matching values mean the file arrived intact.
- Deduplication: identical files produce identical hashes, so backup and storage systems detect duplicates without comparing bytes.
- Data fingerprinting: quick equality checks in caches, databases, and sync systems.
The Hash Generator on EasyToolsBox computes MD5, SHA-1, SHA-256, SHA-384, and SHA-512 locally in your browser, so the data you hash never leaves your device.
Is MD5 secure?
No. MD5 is cryptographically broken. In 2004 researchers produced two different files with the same MD5 hash, and the attack has only gotten cheaper since. In 2008 US-CERT advised that MD5 be treated as broken, and today colliding inputs can be constructed on a laptop. The attack history is summarized in the MD5 article on Wikipedia.
Concretely, MD5 is not safe for:
- Storing passwords. An attacker who steals the hash database can craft or look up matching inputs.
- Digital signatures and certificates. A forged certificate can share an MD5 hash with a real one.
- Anything where an attacker controls both inputs.
It remains fine for integrity checks where the attacker cannot also manipulate the file and the checksum together.
MD5 vs SHA-256: which should you use?
The two differ in output size and collision resistance:
- MD5 produces 128 bits (32 hex characters). Fast and compact, but broken for security.
- SHA-256 produces 256 bits (64 hex characters). Considered collision-resistant today.
For anything security-related, use SHA-256 or SHA-512. For a casual checksum of a file you already trust, MD5 still works, though SHA-256 is the safer default.
How do you generate an MD5 hash?
Using the Hash Generator:
- Open the page and type or paste the text.
- Select MD5 from the algorithm list.
- Copy the resulting 32-character hash.
The tool runs locally via the Web Crypto API, so the text you hash never leaves your browser.
Can an MD5 hash be reversed?
No, but it can be matched. The hash function itself is one-way: no algorithm recovers the input. Attackers instead use rainbow tables, giant precomputed lists of hashes for common passwords, or brute force on weak inputs. A password like "password123" appears in every rainbow table, so its MD5 can be looked up in seconds. Adding a random salt per user makes rainbow tables useless, which is one reason modern password storage uses dedicated functions such as bcrypt or Argon2 instead of MD5.
FAQ
What is the difference between MD5 and SHA-256?
MD5 produces a 128-bit hash (32 hex characters) and is broken for security. SHA-256 produces a 256-bit hash (64 hex characters) and is still considered collision-resistant. Use SHA-256 for anything security-related.
Is MD5 safe to use?
For checksums and file integrity, yes. For passwords, signatures, or anything an attacker could control, no. MD5 has been cryptographically broken since 2004.
Can you reverse an MD5 hash?
No, hashing is one-way. But common passwords can be matched against rainbow tables in seconds, which is why MD5 alone is not acceptable for password storage.
What does an MD5 hash look like?
A 32-character hexadecimal string, for example d41d8cd98f00b204e9800998ecf8427e, which is the MD5 of an empty input.
Why is MD5 still used if it is broken?
It is fast, and the collision attacks require the attacker to control both inputs. For integrity checks on files you already trust, that constraint holds, so MD5 survives in checksums, deduplication, and legacy systems.