Developer · Hashing
MD5 hash generator.
Get the MD5 digest of any text or file as hex or Base64. It runs in your browser, so nothing you type or pick is uploaded.
How to use the MD5 generator
- Type or paste text into the box, or choose a file to hash instead.
- Press the generate button and wait a moment for large files.
- Copy the value, then compare it with the checksum or signature you were given.
About MD5
MD5 produces a 128-bit digest, written as 32 hexadecimal characters. MD5 is broken for security: practical collision attacks have existed since 2004, so two different files can be built to share one MD5. It is still fine for spotting accidental corruption or matching a legacy checksum a publisher lists. For anything an attacker could tamper with, use SHA-256 or stronger.
Your input stays on your device
The calculation runs in your browser inside a sealed frame that cannot make network requests, so the text, file or key you enter is never uploaded. The advertising on this page sits outside the frame and cannot see what you enter.
- Line endings and trailing spaces change the result, so paste exactly what you mean to hash.
- Hashing is one-way: you cannot recover the original input from the digest.
- If a file and text are both provided, the file is hashed.
About MD5
MD5 is the 128-bit message-digest algorithm defined in RFC 1321. Its output is 16 bytes, shown as 32 hexadecimal characters. WebCrypto does not offer MD5, so this page uses a small pure-JavaScript implementation; the SHA pages use the browser's native SubtleCrypto.
Text is converted to UTF-8 bytes before hashing, so héllo hashes the bytes a command-line tool would see on a UTF-8 system. A file is hashed byte for byte. Remember that a trailing newline is part of the input: echo abc | md5sum hashes abc\n, which is a different digest from abc.
Known-answer examples
Use these to confirm the tool matches the standard. The Try button loads the input.
| Input | MD5 (hex) | Source | |
|---|---|---|---|
| Empty string | d41d8cd98f00b204e9800998ecf8427e | RFC 1321 A.5 | |
| a | 0cc175b9c0f1b6a831c399e269772661 | RFC 1321 A.5 | |
| abc | 900150983cd24fb0d6963f7d28e17f72 | RFC 1321 A.5 | |
| message digest | f96b697d7cb7938d525a2f31aaf161d0 | RFC 1321 A.5 |
Sources (retrieved October 2026):
Frequently asked questions
Is MD5 safe to use?
Not where an attacker is involved. Practical collision attacks on MD5 are why RFC 6151 says it is no longer acceptable for digital signatures. For detecting accidental changes (a download that got truncated, a cache key) it still works. Use SHA-256 when someone could deliberately tamper with the data.
Can an MD5 hash be reversed or decrypted?
No. MD5 is a one-way function, not encryption. Websites that "decrypt" MD5 simply look the hash up in tables of precomputed common inputs, which is why short or common strings can be found and long random ones cannot.
Why does my MD5 differ from the one on the command line?
Almost always a newline. echo text | md5sum adds a trailing line feed; use printf or echo -n. Character encoding is the other cause: this page hashes UTF-8 bytes, while some Windows tools hash UTF-16.
Should I store passwords as MD5?
No. MD5 and plain SHA-256 are fast by design, which lets attackers test billions of guesses. OWASP recommends slow, salted algorithms such as Argon2id, bcrypt or PBKDF2.
Is my text or file sent to a server?
No. The digest is computed locally in your browser tab. Nothing is uploaded, logged or stored.
MD5 is not collision-resistant
RFC 6151 states that MD5 is no longer acceptable where collision resistance is required, such as digital signatures. Do not use it to protect passwords or to prove a file has not been tampered with by someone who can craft a collision. It remains fine for catching accidental corruption and for legacy systems that specify it.