CodeKitHubWhat Is This Tool?
MD5 is a hash function that turns any input into a fixed 32-character hexadecimal fingerprint. The same input always produces the same hash, and even a one-character change produces a completely different result. This makes hashes useful for checksums, cache keys, deduplication and data integrity checks.
Security note: MD5 is cryptographically broken — collisions can be manufactured — so it must not be used for passwords or signatures. For those, use SHA-256 (also provided below) or dedicated password hashing like bcrypt. MD5 remains fine for non-security uses like checksums and cache keys.
MD5 dates back to 1992, when Ron Rivest published it as RFC 1321 — which is part of why so many legacy systems still expect it despite its known weaknesses.
Why Use It?
- Generate checksums to verify a file or string wasn't accidentally changed.
- Create deterministic cache keys and deduplication IDs.
- Compare against a known MD5 to check data integrity.
- Get SHA-1 and SHA-256 alongside — no need for a second tool.
- 100% local: your input never leaves the browser.
How to Use
- Type or paste your text into the input box.
- Click "Generate Hash".
- Read the MD5, SHA-1 and SHA-256 results (check "Uppercase" if your system expects capital letters).
- Click "Copy" next to the hash you need.
Example
Input
helloOutput
MD5: 5d41402abc4b2a76b9719d911017c592
SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824Hashes are deterministic: "hello" produces these exact values on every tool, every time.
Which hash should you use?
All three are one-way hashes, but they're not interchangeable — the right choice depends entirely on whether you need security or just a fingerprint.
| Algorithm | Output size | Use it for | Don't use it for |
|---|---|---|---|
| MD5 | 128-bit (32 hex chars) | Checksums, cache keys, deduplication, detecting accidental file changes | Passwords, digital signatures, anything security-sensitive — collisions can be manufactured |
| SHA-1 | 160-bit (40 hex chars) | Legacy system compatibility (e.g. old Git commit hashes) | New security-sensitive designs — practical collision attacks exist since 2017 |
| SHA-256 | 256-bit (64 hex chars) | Digital signatures, TLS certificates, blockchain, checksums where tampering resistance matters | Storing passwords directly — even SHA-256 is too fast for that; use bcrypt, scrypt or Argon2 instead |
Common use cases
- Verifying a downloaded file matches the publisher's checksum before running it, by hashing the file and comparing the result.
- Generating a deterministic cache key from a URL or query string, so identical requests always map to the same cache entry.
- Deduplicating a large list of records by hashing each one and comparing hashes instead of comparing full text.
- Quickly checking whether two copies of a file are byte-identical without opening or diffing them directly.
Why collisions matter for security but not for checksums
A hash collision means two different inputs produce the same hash output — mathematically inevitable for any hash function (since inputs are infinite and outputs are fixed-length), but the practical risk depends entirely on the use case. For a security signature, a deliberately engineered collision lets an attacker substitute a malicious file for a legitimate one while keeping the same hash, which is exactly what's been demonstrated against MD5 since 2004 and against SHA-1 since 2017. For a checksum or cache key, nobody is trying to engineer a collision — you're just checking whether a file was accidentally corrupted or whether two arbitrary strings happen to be identical — so the same mathematical weakness that breaks MD5's security use case has essentially no impact on its non-security uses.
Need to compare multiple algorithms at once?
If you want to see MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of the same text side by side instead of one at a time, use our multi-algorithm comparison tool.
Frequently Asked Questions
Can I decrypt an MD5 hash back to the original text?
No — hashing is one-way by design; the original cannot be computed from the hash. "MD5 decryption" sites just look hashes up in giant precomputed tables of common inputs, which is why unique inputs can't be reversed.
Is MD5 safe for storing passwords?
No, absolutely not. MD5 is fast to brute-force and has known collision attacks. Use bcrypt, scrypt or Argon2 for passwords. MD5 is only acceptable for non-security purposes like checksums.
Why does the same text give a different hash than another tool?
Usually invisible differences: a trailing newline or space, different line endings (\r\n vs \n), or different text encoding. Byte-identical input always gives an identical hash.
What's the difference between MD5, SHA-1 and SHA-256?
They differ in output length and security: MD5 (128-bit) and SHA-1 (160-bit) are both broken for security use; SHA-256 (256-bit) is the current standard and remains secure. When in doubt, use SHA-256.
Is my text sent to a server for hashing?
No. MD5 is computed with JavaScript and SHA-1/SHA-256 with your browser's built-in Web Crypto API — everything stays on your device.