MD5 Hash Generator
Create the MD5 hash of any text or file, entirely in your browser, and check it against a published checksum.
100% client-side · MD5 is for checksums, not for passwords
MD5 is broken for security use. Do not use it to store passwords or to sign anything; use it for checksums only.
What MD5 Is, and Is Not, Good For
MD5 produces a short fingerprint of data, which makes it handy for confirming that a download or copy arrived intact, de-duplicating files and building cache keys. It was designed in 1991 and is now cryptographically broken: it is fast to brute-force and attackers can create different inputs with the same hash. This tool runs a built-in MD5 implementation in your browser and, for anything that must resist an attacker, points you to modern alternatives.
Private by Design
Text and files are hashed in your browser. Nothing is uploaded or stored
Text or Files
Hash typed text instantly, or a file of any size read in chunks
Verify a Checksum
Paste a published checksum and see at once whether it matches
Hex or Base64
Copy the digest in lowercase hex, uppercase hex or Base64
Honest About MD5
Clear warnings that MD5 is not safe for passwords or signatures
No External Code
No third-party libraries are loaded, and network requests are blocked
Explore more free tools in our security tools collection, including our strong random password generator.
Frequently Asked Questions
1. What is an MD5 hash?
MD5 (Message-Digest Algorithm 5) turns any input into a fixed 128-bit value, usually written as 32 hexadecimal characters. The same input always gives the same hash, and a tiny change to the input gives a completely different one. It is a one-way function: you cannot compute the original input from the hash.
2. Is MD5 safe for storing passwords?
No. MD5 is extremely fast, so attackers can test billions of guesses per second on ordinary graphics cards, and unsalted MD5 hashes of common passwords are found instantly in lookup tables. Use a purpose-built password hash instead: Argon2id, bcrypt or scrypt, or PBKDF2 where a FIPS-approved algorithm is required. MD5 is also unsafe anywhere an attacker could craft input, such as digital signatures or certificates, because practical collision attacks have been public since the mid-2000s.
3. What is MD5 still useful for?
Non-adversarial jobs: spotting accidental corruption in a download or copy, de-duplicating files, building cache keys or ETags, and matching identifiers in legacy systems. A matching MD5 only proves the file is intact if the published checksum came from a source you trust, and it does not prove nobody tampered with it. For new work, prefer SHA-256.
4. Why does my hash differ from another tool or the command line?
The hash covers the exact bytes, so invisible differences change it. The usual causes are a trailing newline (the shell command echo adds one; use echo -n), Windows line endings (CRLF) versus Unix ones (LF), stray spaces, and a different text encoding. This tool hashes the text as UTF-8, which is what most tools and languages use.
5. How do I hash a file and verify a checksum?
Choose a file in the file box and the MD5 appears when reading finishes. The file is read in chunks inside your browser and is never uploaded. Then paste the checksum published by the file's source into the verify box: the page tells you whether it matches, ignoring letter case and spaces. It accepts the 32-character hex form or the 24-character Base64 form.
6. Can an MD5 hash be decrypted?
No, because a hash is not encryption and there is nothing to decrypt. Websites that claim to reverse MD5 are really looking your hash up in huge tables of hashes computed from common words and passwords, which only works for short or predictable inputs. This is why unsalted MD5 is a poor choice for passwords.
7. Is my text or file sent anywhere?
No. The hashing code is part of this page and runs in your browser, with no external libraries. The page's content security policy blocks outgoing network requests, which you can confirm in your browser's developer tools. Your input exists only in memory while the page is open, and the only thing the site remembers is your language choice for the menu.
8. What should I use instead of MD5?
For general hashing and file integrity, use SHA-256, SHA-3 or BLAKE3. For passwords, use Argon2id, bcrypt or scrypt. To authenticate a message with a secret key, use HMAC-SHA-256 rather than a bare hash.