🔒 MD5 Hash Generator
Turn any text into its 32-character MD5 hash in the browser, with optional auto-hashing as you type.
Auto-generate while typing
MD5 Hash Result
128-bit · 32 hex chars
Click anywhere on the hash to select it, or use the Copy button above.
About MD5
- • MD5 produces a fixed 128-bit (32 hexadecimal character) hash from any input.
- • The same input always produces the same hash — it is deterministic.
- • MD5 is not suitable for cryptographic security; use SHA-256 or better for passwords.
- • Common uses: checksums, data integrity verification, and non-security identifiers.
- 🔒 Your text is hashed entirely in your browser — nothing is sent to any server.
Related Tools
🆔
🛡️
🔒
📱
UUID Generator
Generate up to 100 version 4, 1 or 7 UUIDs in lowercase or uppercase and copy them in one click.
Password Strength Checker
Check a password against six rules and see a live strength rating with targeted suggestions.
SHA256 Hash Generator
Produce the 64 character SHA-256 hexadecimal digest of any text, computed in your browser with the Web Crypto API.
QR Code Generator
Encode a URL or block of text as a QR code, choose its size and colours, and download the result as a PNG.
What MD5 does to your input
MD5 is a cryptographic hash function published by Ronald Rivest in 1992 and specified in RFC 1321. It maps a message of any length to a fixed 128-bit output, which is conventionally printed as 32 lowercase hexadecimal characters.
The algorithm starts by padding the message. A single 1 bit is appended, followed by enough 0 bits to bring the length to 448 modulo 512, and then the original message length in bits is written as a 64-bit little-endian value. The padded message is therefore always an exact multiple of 512 bits.
Processing works block by block. Four 32-bit registers are initialised to fixed constants. Each 512-bit block is split into sixteen 32-bit words and run through 64 operations, arranged as four rounds of sixteen. Every operation applies a non-linear function of three registers, adds a message word and a constant derived from the sine function, rotates the result left by a fixed amount, and adds it to a register. After each block the four registers are added to their previous values, which is what makes the function impossible to run backwards. Concatenating the final registers gives the digest.
Whatever the input length, the digest is always 32 characters.
The algorithm starts by padding the message. A single 1 bit is appended, followed by enough 0 bits to bring the length to 448 modulo 512, and then the original message length in bits is written as a 64-bit little-endian value. The padded message is therefore always an exact multiple of 512 bits.
Processing works block by block. Four 32-bit registers are initialised to fixed constants. Each 512-bit block is split into sixteen 32-bit words and run through 64 operations, arranged as four rounds of sixteen. Every operation applies a non-linear function of three registers, adds a message word and a constant derived from the sine function, rotates the result left by a fixed amount, and adds it to a register. After each block the four registers are added to their previous values, which is what makes the function impossible to run backwards. Concatenating the final registers gives the digest.
Whatever the input length, the digest is always 32 characters.
Two inputs and their digests
Type the five characters hello into the input box and the tool returns 5d41402abc4b2a76b9719d911017c592. Count them and you have 32 hexadecimal digits, representing 128 bits. Clear the box completely and the digest becomes d41d8cd98f00b204e9800998ecf8427e, which is the MD5 of the empty string and a value worth recognising, because seeing it in a log usually means something that should have carried data was blank.
Now add a single capital to make the input Hello. The digest becomes 8b1a9953c4611296a827abf8c47804d7, which shares nothing with the previous result. This is the avalanche effect: changing one input bit flips roughly half the output bits, so you cannot tell from two digests whether their inputs were similar or completely unrelated.
The same behaviour applies to invisible characters. Typing hello followed by a space, or with a trailing line break, produces a different digest again, because the tool hashes the raw input rather than trimming it. If a checksum you are comparing does not match, an accidental newline at the end of a copied string is one of the most common causes, closely followed by a difference in text encoding.
Now add a single capital to make the input Hello. The digest becomes 8b1a9953c4611296a827abf8c47804d7, which shares nothing with the previous result. This is the avalanche effect: changing one input bit flips roughly half the output bits, so you cannot tell from two digests whether their inputs were similar or completely unrelated.
The same behaviour applies to invisible characters. Typing hello followed by a space, or with a trailing line break, produces a different digest again, because the tool hashes the raw input rather than trimming it. If a checksum you are comparing does not match, an accidental newline at the end of a copied string is one of the most common causes, closely followed by a difference in text encoding.
Where MD5 is still reasonable, and where it is not
Treat MD5 as an integrity check, not a security control. Practical collision attacks, which construct two different inputs with the same digest, have been public since 2004, and they can now be run in seconds on ordinary hardware. That rules MD5 out for digital signatures, certificates, or any situation where an attacker chooses the content being hashed.
It remains acceptable for detecting accidental corruption. Verifying that a large download arrived intact, spotting duplicate files in a backup set, or generating a cache key from a URL are all cases where nobody is trying to deceive you, and MD5 is fast and widely supported. Where security matters, use SHA-256 instead.
Passwords deserve a specific warning. MD5 is far too fast for password storage, and billions of common passwords already appear in public lookup tables, so hashing a password with MD5 offers almost no protection. Use a purpose-built password hash such as bcrypt, scrypt or Argon2, which are deliberately slow and salted.
One more caveat when comparing checksums: a published MD5 hosted on the same server as the file it describes proves very little, since anyone who replaced the file could replace the checksum too.
It remains acceptable for detecting accidental corruption. Verifying that a large download arrived intact, spotting duplicate files in a backup set, or generating a cache key from a URL are all cases where nobody is trying to deceive you, and MD5 is fast and widely supported. Where security matters, use SHA-256 instead.
Passwords deserve a specific warning. MD5 is far too fast for password storage, and billions of common passwords already appear in public lookup tables, so hashing a password with MD5 offers almost no protection. Use a purpose-built password hash such as bcrypt, scrypt or Argon2, which are deliberately slow and salted.
One more caveat when comparing checksums: a published MD5 hosted on the same server as the file it describes proves very little, since anyone who replaced the file could replace the checksum too.
Frequently Asked Questions
Not by calculation. MD5 discards information, so no inverse function exists. However, short or common inputs can be recovered by lookup, because attackers have precomputed digests for billions of words, phrases and passwords. Never treat an MD5 digest as a way to hide a secret value from anyone who obtains it.
The most frequent causes are a trailing newline or space in copied text, a different character encoding such as UTF-8 versus UTF-16, and line-ending differences between Windows and Unix. For files, an incomplete or resumed download will also change the digest. Re-copy the exact string and check for invisible characters.
It is safe for detecting accidental corruption and for non-security tasks such as cache keys and duplicate detection. It is not safe wherever an adversary can influence the input, including signatures, certificates and password storage, because engineered collisions are cheap to produce. Use SHA-256 for anything with a security requirement.
No. The digest is computed by JavaScript running in your own browser tab, so the input never leaves your device and nothing is transmitted to a server. That also means the tool keeps working if your connection drops after the page has loaded.
MD5 always outputs 128 bits regardless of input size. Each hexadecimal character encodes four bits, so 128 divided by 4 gives 32 characters. A digest of any other length is not MD5: SHA-1 produces 40 hexadecimal characters and SHA-256 produces 64.