MD5 Hash — Generate MD5 Hashes from Text
Generate MD5 hashes from text input. 32-character hex digest, works in your browser — no upload, no server round-trip.
MD5 Hash Generator
Generate MD5 hashes from text. Works entirely in your browser using Web Crypto API.
MD5 is the most famous broken cryptographic hash function. It was designed in 1991 by Ron Rivest as a fast, 128-bit digest for file integrity checks and digital signatures, and for a decade it served that role. In 2004, a team led by Xiaoyun Wang demonstrated the first collision attack: two different 128-byte inputs that produced the same MD5 hash. In 2007, Marc Stevens et al. demonstrated a chosen-prefix collision, which allowed attackers to create two different documents (e.g. two different SSL certificates) with colliding MD5 hashes. Since then, MD5 has been banned from any security-sensitive application, and the web has moved to SHA-256.
Despite being broken for security, MD5 persists for one reason: it is fast, simple, and deeply embedded in legacy systems. Cache key deduplication, non-security file integrity checks, and legacy APIs that still require MD5 digests are the three legitimate use cases in 2026. For any new system, SHA-256 is the minimum acceptable hash function. For password hashing, the minimum is bcrypt with a cost factor of 12 or higher, or Argon2id with recommended memory and iteration parameters. MD5 for passwords has been unacceptable since at least 2010.
The MD5 hash tool computes the digest in your browser with the Web Crypto API — or a fast pure-JavaScript implementation if the browser does not support the API — and shows the 32-character hex digest immediately. The comparison feature lets you paste two hashes side by side to check if two pieces of text match. For file integrity checks where the file content matters, use the SHA-256 tool on this site, which reads the file’s bytes directly in your browser without uploading.
How to use
Enter your text
Type or paste the text you want to hash. The hash updates in real-time as you type. Paste a file path? The tool hashes the text, not the file — use SHA-256 for file integrity checks.
Copy the MD5 digest
The 32-character hexadecimal digest appears immediately. Copy it with one click. The output is lowercase hex by default; toggle 'uppercase' for uppercase hex output.
Compare two hashes
Paste a second hash into the 'compare' field to check if two pieces of text produce the same MD5 digest. The comparison is case-insensitive and highlights the match or mismatch.
Frequently asked
Why should I NOT use MD5 for passwords?
MD5 is cryptographically broken and should never be used for hashing passwords. Collision attacks that produce two different inputs with the same MD5 hash were demonstrated in 2004, and chosen-prefix collisions were demonstrated in 2007. For password hashing, use bcrypt, scrypt, or Argon2id — never MD5.
What is MD5 still useful for?
MD5 is still used for non-security checksums: verifying file integrity against accidental corruption (not deliberate tampering), deduplication of cache keys, and compatibility with legacy systems that still require MD5 digests. For security-sensitive integrity checks, use SHA-256.
What is the output format?
The output is a 32-character lowercase hexadecimal string. MD5 produces a 128-bit (16-byte) digest, which is represented as 32 hex characters. Toggle 'uppercase' in the output options for uppercase hex output.
Can it hash a file?
No. This tool hashes the text string you paste in. For file hashing, use the SHA-256 tool on this site, which reads the file's bytes directly in the browser and hashes them without uploading — or use your operating system's built-in tool (`md5` on macOS, `CertUtil` on Windows, `md5sum` on Linux).
What does a 'collision attack' mean?
A collision is two different inputs that produce the same MD5 hash. A collision attack is a method for finding such pairs deliberately, faster than random guessing. MD5's collision resistance was broken by Wang et al. in 2004 and has been fully compromised since. This is why MD5 should never be used for security purposes, only for legacy checksums.
Limitations
- Not for cryptographic securityMD5 is broken for collision resistance. Never use MD5 for password storage, digital signatures, SSL certificates, or any purpose where an attacker might try to find a second input that matches a given hash. Use SHA-256 or a modern password hashing algorithm.
- Text only, no file hashingThe hash is computed on the text string you paste. For file hashing, use the SHA-256 tool, which reads file bytes directly in the browser.
- No HMAC-MD5HMAC (Hash-based Message Authentication Code) uses a secret key with the hash function. This tool computes the raw MD5 digest only. For HMAC with a key, use a dedicated HMAC tool or library.
Platform notes
- macOS
- The macOS terminal command is `md5 -s 'your text'` or `md5 filename` for file hashing. The browser tool is the right pick for one-off hashing without opening a terminal.
- Windows
- PowerShell: `[System.BitConverter]::ToString([System.Security.Cryptography.MD5]::Create().ComputeHash([System.Text.Encoding]::UTF8.GetBytes('text')))` is the equivalent. The browser tool is more convenient for one-off hashing.
- Linux
- The CLI equivalent is `echo -n 'text' | md5sum`. The browser tool is the right pick for one-off hashing where the system's md5sum is not available or you don't want to leave text in the shell history.
- Web
- Runs entirely client-side. No network requests. The hash computation is near-instant for text of any practical length.