What Is an MD5 Hash?

An MD5 hash is a 128-bit "fingerprint" of a piece of data. Feed any input — a word, a file, a whole disk image — and MD5 turns it into a fixed 32-character hexadecimal string. The same input always produces the same hash, but the original input can't be recovered from it.

MD5 stands for Message Digest Algorithm 5. Ron Rivest designed it in 1991 as a faster successor to MD4, and it was published the following year as RFC 1321. It is not encryption, it is not reversible, and since 2004 it has been treated as cryptographically broken — yet it still turns up in checksums, build pipelines and legacy code everywhere.

hello  →  5d41402abc4b2a76b9719d911017c592

How MD5 works

MD5 takes an input of any length and reduces it to a single 128-bit value. Under the hood it does four things:

• Pad the input to a multiple of 512 bits, appending a single 1 bit, then zeros, then the original length as a 64-bit number.
• Load a 128-bit state — four 32-bit words, each starting from a fixed constant defined by the algorithm.
• Mix every 512-bit block through four rounds of sixteen operations, combining addition, bitwise XOR and left rotation.
• Output the final state as 128 bits, conventionally written as 32 lowercase hexadecimal characters.

Two properties fall out of that design. It is deterministic — the same input always yields the same digest. And it has a strong avalanche effect — changing one bit of input changes about half the output bits, which is why hello and Hello look nothing alike.

MD5 hash examples

Every MD5 output is exactly 32 hex characters, no matter how long the input is:

Note the case sensitivity: capitalising the first letter of hello produces a completely unrelated digest. Hashing is byte-exact, so a trailing space or a Windows-style CRLF line ending changes the result just as thoroughly.

Hashing is not encryption

This is the most important distinction to understand. Encryption is reversible — it scrambles data in a way that can be undone with the right key. Hashing is one-way: it produces a fixed-size digest, and there's no key that turns the digest back into the original.

Because of that, hashing isn't for hiding data you need to read back. It's for verifying data — checking that a file hasn't changed, or that a password matches without storing the password itself.

This is why the phrase "MD5 encryption" is a misnomer. MD5 has no key, so there is nothing to encrypt with and nothing to decrypt. If you need to protect data so it can be read back later, that's encryption — AES or ChaCha20. If you need to check that data hasn't changed, that's hashing — MD5, SHA-1, SHA-256. Tools that advertise "MD5 decrypt" aren't reversing the function; they're looking your hash up in a table of precomputed guesses.

What MD5 is good for

• Checksums — confirming a downloaded file matches the publisher's hash, so you know it wasn't corrupted or tampered with.
• Deduplication — quickly comparing two large strings or files by comparing their hashes instead.
• Non-cryptographic fingerprinting — e.g. cache keys and integrity checks where security isn't the goal.

What MD5 is not good for

MD5 dates from 1991, and its age shows. A collision means two different inputs produce the same hash, which destroys the core property that made a hash useful for security. Practical collisions for MD5 were demonstrated in 2004; by 2008 researchers had used them to forge a rogue certificate authority certificate. Anything that has to resist a deliberate attack should not be built on MD5:

• Password hashing — use a slow, salted algorithm like bcrypt, scrypt, or Argon2 instead.
• Digital signatures — use SHA-256 or SHA-3, which have no practical collision attacks.
• Any security boundary — if an attacker being able to forge a hash matters, MD5 is the wrong tool.

For modern security needs, SHA-256 is the standard choice. It produces a longer 64-character hash and remains collision-resistant.

MD5 vs SHA-1 vs SHA-256

All three produce a fixed-length digest and are equally easy to compute. The difference is how well they hold up against someone actively trying to break them:

One thing that table can't show: none of the three belong anywhere near a password. They are all designed to be fast, and fast is exactly what an attacker wants. Password storage needs a deliberately slow, salted key-derivation function — bcrypt, scrypt or Argon2id.

Can you reverse an MD5 hash?

Not mathematically. MD5 is a one-way function: the digest is a lossy summary of the input, and many different inputs can map onto the same output, so there is no inverse to compute.

In practice, though, MD5 is easily cracked — not by reversing the maths, but by guessing. Because it is fast and usually unsalted, an attacker can hash billions of candidate inputs per second and compare the results. Precomputed tables of common passwords make it worse: 5f4dcc3b5aa765d61d8327deb882cf99 is password, and public lookup services return that instantly.

That gap between "cannot be reversed" and "cannot be cracked" is the whole reason MD5 fell out of favour for credentials. Salting adds a per-user random value so precomputed tables stop working, and a slow algorithm makes each individual guess expensive. Together they turn a trivial lookup back into an impractical search.

How to generate an MD5 hash

You can hash text instantly with our free MD5 hash generator, which runs entirely in your browser:

• 1.Type or paste the text you want to hash.
• 2.Press Hash to compute the MD5 digest.
• 3.Copy the 32-character result and use it as a checksum, cache key or comparison value.

Nothing is uploaded — the digest is computed locally, which matters when the string you are hashing is sensitive.

How to check a file's MD5 checksum

Text is not the only thing you can hash. Most operating systems ship a command-line utility that prints the MD5 of a file, so you can compare it against the value a publisher lists on their download page:

If the printed hash matches the published one, the file arrived intact. If it does not, the download was truncated, corrupted or swapped in transit — do not run it. Given MD5's collision weakness, a mismatch is meaningful, but a match only proves the file is the one the publisher hashed, not that the publisher is trustworthy.

Frequently asked questions