Should I use MD5 for passwords?

Never. MD5 is fast and unsalted by design, so leaked MD5 password hashes are cracked at billions of guesses per second. Use bcrypt, scrypt, Argon2 or PBKDF2 with a unique salt per user. [Password Encryption](/password-encryption) generates hashes in those formats.

Why is my hash different from another tool's?

The inputs differ by at least one byte. The usual culprits are a trailing newline (echo adds one unless you pass -n), Windows CRLF line endings instead of LF, a different text encoding, or a UTF-8 byte order mark. This tool hashes exactly the characters in the box as UTF-8 with nothing appended.

What is the MD5 of an empty string?

d41d8cd98f00b204e9800998ecf8427e. Clear the text box and that is what the MD5 row shows. It is a handy sanity check: if a script reports that value for a file, the file it read was empty, which usually means a wrong path or a failed download rather than a genuinely empty file.

Is MD5 or SHA-256 better for checking downloads?

SHA-256. Both catch accidental corruption, but only SHA-256 resists an attacker who wants two different files to share a digest. Use MD5 when the publisher lists nothing else, and understand that it then proves the file is intact, not that it is the file the publisher intended.

Does the tool upload my file?

No. The browser reads the file with the File API and hashes it in page JavaScript: MD5 with a small built-in implementation, SHA-1 and SHA-256 with the Web Crypto API. No request leaves the page during hashing, and the result disappears when you reload.

Checksums

MD5 Hash Generator

Type or paste text and the tool shows its MD5, SHA-1 and SHA-256 digests as you type. Choose a file and it computes the same three checksums without uploading it. Paste the hash a download page publishes into the verify box and the tool says whether it matches any of the six values. Everything runs in your browser, which suits checking installers, backups and configuration files, or reproducing a legacy MD5 that an older system still expects.

Text

MD5

6cd3556deb0da54bca060b4c39479839

SHA-1

SHA-256

File checksum

Choose file

Choose a file to compute its checksum locally — it isn't uploaded anywhere.

Verify against an expected hash

Loading MD5 Hash Generator...

Querying live edge resolvers and network infrastructure...

How to use the MD5 Hash Generator

Type or paste text into the Text box. The MD5, SHA-1 and SHA-256 rows update on every keystroke and each has a copy button.
Click Choose file under File checksum to hash a file from your disk. Its name, size and three digests appear once it has been read.
Paste the published checksum into Verify against an expected hash. A green Match or a red No match appears immediately.
Prefer the SHA-256 line when the publisher offers it, and fall back to MD5 only when that is all they list.

What to look for

Three digests from one input

MD5 gives a 128-bit digest written as 32 hex characters, SHA-1 160 bits as 40, and SHA-256 256 bits as 64. All three are computed from the same bytes, so you can compare against whichever one a vendor publishes without re-entering anything. Hashes are shown in lower-case hex.

Verification is exact

The verify box compares your pasted value, trimmed and lower-cased, against all six digests (three for the text, three for the file). A single wrong character means no match, which is the point: a checksum either matches byte for byte or it does not, and a near miss is a failure.

MD5 is a checksum, not a security control

Collisions for MD5 can be manufactured on ordinary hardware, so it cannot prove a file was left alone by someone who wanted it to pass, and it must never store passwords. It still catches accidental corruption and truncated downloads. For passwords, use [Password Encryption](/password-encryption).

Guide

Checksums, hashes and what MD5 is still good for

How a hash function turns input into a fingerprint

A cryptographic hash reads input of any length and produces a fixed-size digest. MD5 (RFC 1321) pads the input, appends its original length, and processes it in 512-bit blocks, mixing each block into four 32-bit state words through 64 rounds of additions, rotations and bitwise functions. The final state, written out as 16 bytes, is the digest. SHA-1 and SHA-256 follow the same block-and-compress design with larger state and different round functions.

Two properties matter in practice. The function is deterministic, so the same bytes always give the same digest: the MD5 of the word hello is 5d41402abc4b2a76b9719d911017c592 everywhere. And it is sensitive to every bit: hello followed by a newline hashes to b1946ac92492d2347c6235b4d2611184, with nothing in common. That is why a text-box hash and a file hash can disagree when the file ends with a line break.

The tool hashes text as UTF-8, exactly as typed, with no trailing newline added. Files are read in full and hashed as raw bytes, so a file's digest matches what md5sum, sha1sum or sha256sum print on Linux, certutil -hashfile on Windows, or shasum -a 256 on macOS.

Verifying a download step by step

Download the file, then find the checksum the publisher lists, usually next to the download link or in a file named SHA256SUMS or MD5SUMS. Choose the file in the tool, wait for the three digests, and paste the published value into the verify box. A match means the bytes on your disk are the bytes the publisher hashed. A mismatch means the download was corrupted, truncated, or is a different build.

A matching MD5 only proves integrity against accidents. If an attacker controlled the download page they could publish the hash of their own file, and with MD5 they could even craft a file whose digest matches a legitimate one. Vendors who care about this sign their checksum files with PGP or publish SHA-256. Prefer those when they exist and treat MD5-only listings as a corruption check, nothing more.

Hash the archive you downloaded, not the files it extracts. Publishers hash the archive.
Copy the published hash without surrounding text. Stray spaces are trimmed but extra letters are not.
If the length is wrong for the algorithm (32, 40 or 64 hex characters), you copied the wrong line.

Why MD5 cannot protect passwords

A password hash has to be slow and salted so that a stolen database cannot be reversed by brute force. MD5 is the opposite: it was designed for speed, and modern GPUs compute billions of MD5 digests per second, so unsalted MD5 passwords fall to dictionary attacks and precomputed tables in minutes. The so-called MD5 decrypters online are lookup tables of common inputs, not a reversal of the function.

Store passwords with a function built for the job: bcrypt, scrypt, Argon2 or PBKDF2 with a per-user salt and a cost factor tuned to your hardware. Password Encryption produces those hashes and lets you compare the formats. The same reasoning applies to API tokens and session identifiers: if the value is secret, MD5 is the wrong tool.

MD5 also fails as a signature or a tamper seal. Collision attacks let someone prepare two different documents with the same digest, so a contract or an installer verified only by MD5 could be swapped for a prepared twin. SHA-1 has a demonstrated collision as well. SHA-256 has no known practical collision and is the sensible default for anything security-related.

Where the tool fits and where it stops

Legitimate MD5 uses survive: cache keys, deduplication, ETags, checksums inside file formats and compatibility with older systems that expect a 32-character digest. The tool is a quick way to produce one, or to confirm what a script generated. SHA-1 and SHA-256 come from the browser's Web Crypto API while MD5 is implemented in plain JavaScript, so on large files the MD5 row takes a moment longer.

Limits are those of your browser. A file is read entirely into memory before hashing, so multi-gigabyte files may stall or fail depending on the device. Nothing is uploaded and no history is kept. Refreshing the page clears the result. Hashing is also not encoding: if you need text to survive a transport rather than be fingerprinted, Base64 Encoder / Decoder is the right tool.

Knowledge Base & FAQ

MD5 Hash Generator FAQs

Common questions about the md5 hash generator.

No. A hash is one-way. There is no key and no inverse function. Sites that claim to decrypt MD5 keep large tables of digests for common words and passwords and look yours up. If your input was short or common it will be found. A random 20-character string will not be, but that is obscurity rather than security.

Related Diagnostic Tools

Combine diagnostics for deep-dive network and DNS troubleshooting.

View All Tools

Website OS Checker

Find out which operating system and web server a website runs on.

Base64 Encoder / Decoder

Encode and decode Base64 text and files, including URL-safe and data URIs.

Multi-URL Opener

Open a list of URLs in new tabs at once, with de-duplication and validation.