App Interface
Security Node Active
Generating MD5 HASH GENERATOR Hash
What an MD5 hash is
MD5 is a hash function: it takes input of any length and produces a fixed 128-bit value, normally written as 32 hexadecimal characters. The same input always gives the same hash, and changing even one character gives a completely different one. That makes MD5 handy as a fingerprint. Developers use it to build cache keys, compare whether two strings are identical without storing them, generate ETags, check the values a legacy system expects, or reproduce a checksum published next to a download.
This generator calculates the hash in your browser with the widely used CryptoJS library. Your text is not submitted to the server.
How to generate an MD5 hash here
- Type or paste your text into the box.
- Click Generate Hash. The button stays disabled until there is some input.
- The 32-character result appears below. Click Copy Signature to copy it.
The text is encoded as UTF-8 before hashing, which matches what most programming languages and command-line tools do by default, so results can be compared directly.
Worked example
| Input | MD5 hash |
|---|---|
hello | 5d41402abc4b2a76b9719d911017c592 |
Hello | 8b1a9953c4611296a827abf8c47804d7 |
hello (with a trailing space) | f814893777bcc2295fff05f00e508da6 |
The table shows the property that makes hashes useful: one capital letter or one invisible space changes the whole output. You can confirm the first row in a terminal with printf hello | md5sum on Linux or md5 -s hello on macOS.
What it does not do
- It hashes text, not files. To fingerprint a download or document, use the File Hash Generator, which reads the file's bytes.
- It cannot reverse a hash. MD5 is one-way. Websites that claim to decrypt MD5 simply look the hash up in a list of previously hashed common strings.
- Empty input is not hashed. For reference, the MD5 of an empty string is
d41d8cd98f00b204e9800998ecf8427e.
Tips and common mistakes
- Line endings matter. Text copied from a file may end with a newline, and
echo hello | md5sumhasheshelloplus a newline. If your result does not match another tool, check for trailing newlines and spaces first. - Never use MD5 for passwords. It is extremely fast to compute, so attackers can test billions of guesses per second. Use a slow, salted algorithm such as bcrypt or Argon2 instead.
- Do not rely on MD5 for security against tampering. Practical collision attacks exist, meaning someone can craft two different inputs with the same MD5. For signatures and integrity checks against an attacker, use SHA-256.
- MD5 is fine for non-adversarial jobs such as detecting accidental changes, deduplicating records or building cache keys.
- Upper or lower case output. The tool prints lower-case hex. Hashes are compared case-insensitively, so
5D41...and5d41...are the same value.
Related concepts
Hash vs encryption
Encryption is reversible with a key; hashing is not reversible at all. You encrypt data you need to read again, and hash data you only need to compare.
Collisions
Because MD5 squeezes unlimited input into 128 bits, different inputs must sometimes share a hash. For a good hash function, finding such a pair should be impractical. For MD5 it no longer is, which is why it was retired from security uses.
SHA-256 and the SHA-2 family
SHA-256 produces a 64-character hex digest and has no known practical collisions. It is the usual replacement wherever MD5 was used for security, and most modern download pages publish SHA-256 checksums instead of MD5.
Typical MD5 uses today
MD5 is still found in many places where speed matters and nobody is trying to forge input: content-addressed caches, the ETag headers some web servers send, database columns that index long URLs by a short fixed-length key, and older APIs that sign requests with an MD5 of the parameters plus a shared secret. If you are integrating with such a system, this generator lets you check by hand that your code is producing the value the other side expects before you start debugging anything else.
Frequently Asked Questions
Can an MD5 hash be decrypted?
No. MD5 is a one-way function. Online lookup sites only find hashes of strings that someone has already hashed and stored, which is why short or common inputs can be found.
Why does my MD5 not match the one from the command line?
The command-line input usually includes a trailing newline from echo. Use printf, or remove trailing spaces and newlines, so both tools hash exactly the same bytes.
Is MD5 secure enough for passwords?
No. It is too fast and has known weaknesses. Use bcrypt, scrypt or Argon2 for password storage.
Is the text I enter sent to your server?
No. The hash is calculated in your browser with JavaScript.
How long is an MD5 hash?
128 bits, shown as 32 hexadecimal characters.