MD5 hash generator.

MD5 is a 128-bit hash Ronald Rivest published in 1992 (RFC 1321) to replace MD4, written as 32 hexadecimal characters. For a decade it was the checksum of the internet: file downloads, password tables, certificate signatures.

Yes. Collisions were published in 2004, chosen-prefix collisions in 2007, and in 2008 researchers used one to forge a trusted certificate authority; the Flame malware did the same in 2012. A collision now takes a second on a laptop. Never use MD5 for passwords, signatures or anything an attacker could influence.

Checksums against accidental damage: a download that matches its published MD5 was not truncated or corrupted in transit, even if it could have been swapped by someone determined. Also cache keys, ETags, deduplication of trusted data, and matching values in systems that already store MD5s.

No, a hash is one-way. But MD5 is fast and most passwords are short, so a precomputed table or a GPU trying billions of guesses a second finds the input for most unsalted MD5 password hashes in minutes. That is why passwords need bcrypt or Argon2id, not a fast hash.

Oddly, yes. HMAC's security does not depend on collision resistance, so HMAC-MD5 has never been practically broken and still appears in old protocols. There is no reason to choose it for anything new; HMAC-SHA-256 costs nothing more.

Nothing leaves your browser. The hash is computed on your machine, by the browser's Web Crypto API or a WebAssembly build of the algorithm loaded on first use, and the page makes no request with your input. You can load the page, go offline and keep hashing.

Drop the file onto the input or choose it with the button, and the tool reads it in your browser and hashes the bytes. Files up to 1 GB work; past that the browser would need the whole file in memory, so the tool declines. Paste the published digest into the Verify field to compare.

Hex is the common form: 32 characters from 0 to 9 and a to f, the same value in upper or lower case. Base64 writes the same 16 bytes in fewer characters, and Base64url swaps + and / for - and _ with no padding. Switch the output and the digest is re-encoded, not recomputed.

Text is hashed as UTF-8 bytes, which is what every language and command line does by default. A trailing newline changes the digest, so `echo -n` or this tool's input, with no newline added, matches a command-line tool run on a file without one.

Turn on HMAC and enter the secret: the tool computes HMAC-MD5 over the input with that key, the standard RFC 2104 construction, so the value matches what a server-side HMAC library produces. The key is hashed as UTF-8 text.

No. The MD5 hash generator is free and opens without a sign-in, an account or an install.

Nothing. The MD5 hash generator holds your input in the page's memory, so closing or reloading the tab clears it, and it saves nothing in this browser.

The toolbar switches to MD4, SHA-1, and RIPEMD-160 without leaving the page. Each one reads the same input, so you can compare digests side by side.

MD5 is computed by a WebAssembly build from the hash-wasm library, which the page loads the first time you hash something and reuses after that.

Yes: the File to MD5 page has the same algorithms and options and opens on the file pane. Files are read in your browser and never uploaded.

Not on its own. MD5 is built to be fast, and fast hashes are cheap for an attacker to guess against. Passwords need a salted, deliberately slow hash: use Argon2id, Argon2d, and bcrypt from the hash generators, which draw a fresh random salt each time.

Closest to the MD5 hash generator: File to MD5, SHA-256 hash generator, SHA-1 hash generator, CRC32 hash generator. Each opens on its own page, free and in the browser.

The MD5 hash generator is one of 64 in its group. The group's page, /tools/hash, lists them all.

The tool is free. Its interface is built from shadcn.io's own components (Button, Input, Slider and the rest of the registry under /ui), which come in React, Vue, Svelte and Solid. Pro adds the blocks and templates for the product around it.