MD5 Hash Generator

MD5 is fast and produces a compact fixed-length fingerprint, which keeps it useful for checksums, cache keys and deduplication. It is not, however, cryptographically secure: practical collision attacks have existed since 2004, meaning an attacker can construct two different inputs with the same digest. That rules it out for password storage, digital signatures and anything where an adversary controls the input. For those, use SHA-256 or, for passwords specifically, a slow purpose-built function such as bcrypt or Argon2. Note also that hashing is one-way — the "MD5 decrypt" sites you may have seen are simply looking your hash up in a table of precomputed common strings.

MD5 pads the message to a multiple of 512 bits, appends the original length, then runs four rounds of 16 operations over each block, mixing a 128-bit state with a table of constants derived from the sine function. The final state, written as 32 hexadecimal characters, is the digest.

MD5 is not a security function. Collisions can be produced deliberately, so it must never be used for passwords, signatures or any decision an attacker could influence. This tool hashes text you paste rather than files directly, and hashing is one-way — a digest cannot be turned back into the original input.

Hashing the string "abc" always produces 900150983cd24fb0d6963f7d28e17f72 — one of the published RFC 1321 test vectors. Change a single letter and the digest changes completely.

1. Paste the text you want to hash.
2. Choose plain MD5, or HMAC-MD5 and supply a secret key.
3. Optionally paste an expected hash to verify against.
4. Copy the 32-character hexadecimal digest.

• Using MD5 to store passwords — it is far too fast and long since broken.
• Expecting to reverse a hash back into the original text; that is not possible.
• Comparing hashes generated from text with different line endings or trailing spaces.
• Treating a matching MD5 as proof of authenticity when an attacker controls the file.

The MD5 Hash Generator produces the 128-bit MD5 digest of any text, following RFC 1321 exactly. It also supports keyed HMAC-MD5 for message authentication, and includes a checker that compares your result against an expected hash so you can confirm two pieces of content are identical.

Developers verifying checksums, sysadmins comparing files and anyone integrating with a legacy system that still requires MD5.

• Implements RFC 1321 exactly — verified against the official test vectors.
• Includes HMAC-MD5, which browsers cannot produce natively.
• Built-in checker tells you whether a digest matches, with a plain-English verdict.
• Handles full UTF-8 text, including emoji and accented characters.

• Verifying that a downloaded file matches its published checksum.
• Generating cache keys or deduplication fingerprints.
• Producing an HMAC-MD5 signature for a legacy API.
• Confirming two copies of a document are byte-for-byte identical.