MD5 turns any text or file into a 128-bit hash, written as 32 hex characters. It is fast and everywhere, so it is still common for file checksums, cache keys, and spotting duplicates.
Is MD5 secure?
No. Researchers have been able to create two different inputs with the same MD5 hash since 2004, so it must not be used for passwords, signatures, or certificates. It is still fine for catching accidental corruption, where nobody is trying to fake a match.
Checking a download
Click Hash a file and choose the file, then paste the checksum published by the site you downloaded it from into Check against a hash. A match means your copy is identical to the original, byte for byte.
Example
hello
// MD5
5d41402abc4b2a76b9719d911017c592
From the command line
# macOS
md5 file.zip
# Linux
md5sum file.zip
# Windows
certutil -hashfile file.zip MD5
Frequently asked questions
How long is an MD5 hash?
128 bits, written as 32 hexadecimal characters.
Can I decrypt an MD5 hash?
No. MD5 is a one-way hash, not encryption. Common inputs can be looked up in precomputed tables, which is another reason not to use it for passwords.
What should I use instead of MD5?
SHA-256 for checksums and signatures, and bcrypt, scrypt, or Argon2 for passwords.
Is the MD5 of a file uploaded to calculate it?
No. The file is hashed in your browser and never leaves your device.