MD5 Hash Generator

How MD5 Works

MD5 (Message Digest 5) was designed by Ronald Rivest at MIT and published in 1992 as RFC 1321. It follows the Merkle-Damgard construction, which means it chews through a message in fixed size chunks and carries a running internal state from one chunk to the next. That state is what eventually becomes the digest, so every byte of input influences the final answer.

Before any hashing happens, the input is padded. MD5 appends a single 1 bit, then as many 0 bits as needed, then a 64-bit little endian count of the original message length in bits. The padding is chosen so that the total length is an exact multiple of 512 bits. That length field matters more than it looks: it is what stops two different messages that happen to share a byte prefix from colliding trivially.

The internal state is 128 bits wide, held as four 32-bit words traditionally called A, B, C, and D, initialized to fixed hexadecimal constants. Each 512-bit block is split into sixteen 32-bit words and pushed through 4 rounds of 16 operations each, 64 operations in total. Every round uses a different nonlinear mixing function (F, G, H, and I), and every one of the 64 operations adds in one message word, one additive constant derived from the integer part of the sine of the step number, and a left rotation by a fixed amount. The result is folded back into the state.

After all blocks are processed, the four words are written out in little endian order and rendered as hexadecimal. That gives you the familiar 128-bit digest, 32 hexadecimal characters long, regardless of whether the input was one character or one gigabyte. MD5 is extremely fast, which was a design goal in 1992 and is precisely the property that makes it unsuitable for security work today.

MD5 Properties

The core numbers behind MD5, useful when you are debugging a digest that came from somewhere else and need to confirm you are looking at the right algorithm.

One practical consequence of the fixed 32 character length: if you are staring at a hexadecimal string and it is exactly 32 characters, MD5 is a very good first guess. 40 characters points to SHA-1, 64 to SHA-256, and 128 to SHA-512.

Example MD5 Hashes

Three reference digests you can use to sanity check any MD5 implementation. The empty string value in particular shows up constantly in logs and databases, and recognizing it on sight saves a lot of confusion.

Paste any of those inputs into the generator above and you will get the same digest back, because MD5 is deterministic. Then change one character, for example from hello to Hello, and watch the entire output change. That is the avalanche effect: a single flipped input bit should flip roughly half the output bits, with no visible relationship between the two digests.

What MD5 Should and Should Not Be Used For

MD5 is not useless, it is just badly misunderstood. It is a perfectly good non-cryptographic fingerprint and a genuinely bad security primitive. The dividing line is whether an attacker gains anything by making two inputs collide.

Appropriate uses

• Verifying that a file downloaded correctly, where you only care about accidental corruption rather than deliberate tampering.
• Deduplication, for example spotting that two uploaded images are byte for byte identical before storing both.
• Cache keys and shard keys, where you need a short stable identifier derived from a longer value.
• ETags and change detection, where you rehash a record and compare against the previous digest to decide whether to re-render or re-sync.
• Reading legacy data, since huge amounts of older software emitted MD5 and you still have to interoperate with it.

Do not use it for

• Password storage, in any form, salted or not.
• Digital signatures and code signing, where a collision lets an attacker swap the signed artifact.
• TLS or any other certificate, which no modern trust store has accepted for well over a decade.
• Any commitment scheme or anti-tamper check where the party supplying the data is the same party you are defending against.
• Deriving keys or tokens that are supposed to be unpredictable.

The reason for that second list is concrete. Collision attacks against MD5 were demonstrated in 2004 and refined until finding two distinct inputs with the same digest became a matter of seconds on ordinary consumer hardware. Researchers went on to build colliding X.509 certificates and, in the Flame malware, a forged code signing certificate that a real operating system trusted. If your threat model includes anyone who benefits from two files hashing the same, MD5 gives you no protection at all.

Why You Should Not Hash Passwords With MD5

MD5 password hashing is the single most common security mistake still found in legacy PHP and classic ASP codebases, and it fails for a reason that has nothing to do with the collision attacks above. It fails because MD5 is fast.

A commodity GPU can compute tens of billions of MD5 hashes per second. That means an attacker holding a stolen user table does not need to break MD5 at all. They simply hash every entry in a leaked password wordlist and compare. Against unsalted MD5 the situation is worse still, because identical passwords produce identical digests, so the attacker can crack the whole table at once and can look answers up in precomputed rainbow tables that have existed for MD5 since the mid 2000s.

A per user random salt, stored alongside the hash, fixes the shared-digest problem and kills rainbow tables, but it does not slow anything down. The attacker just cracks each account separately instead of all at once, still at billions of guesses per second.

The real fix is a password hashing function that is deliberately slow and deliberately memory hungry, with a cost parameter you can raise as hardware improves. Use Argon2id where you can, and bcrypt or scrypt where you cannot. These functions take a tunable fraction of a second per hash, which is invisible to a user logging in once and catastrophic for an attacker trying a billion candidates. If you have inherited an MD5 password table, the standard migration is to rehash on next successful login and to force a reset for anyone who does not return.

MD5 is one of several digests you may need side by side. Browse the full set of free developer tools to compare MD5 against SHA-1, SHA-256, and SHA-512 output, or to move between related formats with the Base64, URL, and hex encoding utilities.