MD5 Hash Generator

What MD5 is

Ronald Rivest designed MD5 in 1991 and published it as RFC 1321 the next year. It replaced MD4. The function processes the message in 512-bit blocks and keeps a state of four 32-bit words, named A, B, C, and D in the RFC. Each block is mixed in through 64 steps that use a nonlinear function, a constant from a sine table, and a rotate. At the end the four words are written little-endian. Four times 32 bits is 128 bits, so the hex digest is always 32 characters. The little-endian byte order is why a hand-rolled implementation that stores the words big-endian will match no test vector even when the round logic is right. This page follows the RFC's byte order.

Web Crypto's digest method accepts SHA-1, SHA-256, SHA-384, and SHA-512. It does not accept MD5. That omission is intentional in the browser specifications: MD5 is obsolete as a cryptographic hash, and exposing it in the standard API would invite new uses. File formats and download pages still print MD5 checksums, so a practical checker has to implement the function itself. The code on this page is that implementation. It does not call a server, and it does not pretend the browser has an MD5 subtle-crypto name. If you open the developer tools you will not see a network request for the digest.

Collision resistance failed in public in 2004, when Xiaoyun Wang and coauthors presented collisions. Chosen-prefix collisions followed, and they were good enough to use in real attacks, including the Flame malware's abuse of an MD5 certificate collision. A preimage, going backward from a digest to an unknown file, is not the attack you should worry about. The attack you should worry about is a second file built to share a checksum the victim already trusts. That is exactly the shape of a mirrored download. An MD5 printed next to a file detects accidental corruption, a truncated download, or a bit flip. It does not stop an attacker who can supply both a malicious file and a matching checksum, and it does not stop an attacker who can build a second file once the checksum is fixed.

The empty input is a checksum people meet by accident. MD5 of zero bytes is d41d8cd98f00b204e9800998ecf8427e. If a download page shows that value, the file they hashed was empty, or they hashed a string they did not mean to hash. It is also what this page returns when the text area is blank and no file is attached. A one-letter check is the RFC sample a, which hashes to 0cc175b9c0f1b6a831c399e269772661. Those two samples, plus abc, are enough to tell a correct MD5 from a function that only looks similar.

Download pages still print 32 hex characters. A longer string is not this function. Forty characters point at the SHA-1 generator, sixty-four at the SHA-256 generator, and one hundred twenty-eight at the SHA-512 generator. A check that only succeeds when you also hold a secret belongs on the HMAC generator. If you were handed the string and not the name, start with the hash identifier.

Test vector for abc

RFC 1321 appendix A.5 lists abc and the digest 900150983cd24fb0d6963f7d28e17f72. The letters are lowercase, there is no newline, and there is no trailing space. Generate that from the text area with the file control cleared. The expected-hash field treats 900150983CD24FB0D6963F7D28E17F72 as the same value. It also accepts the hex with spaces between bytes, which is how some Windows tools print it. A Base64 expected value must be kAFQmDzST7DWlj99KOF/cg== when the output control is Base64.

A longer RFC sample shows the padding across two blocks. The message 12345678901234567890123456789012345678901234567890123456789012345678901234567890, eighty digits, hashes to 57edf4a22be3c955ac49da2e2107b67a. Implementations that handle a short string and fail a long one usually get the length field wrong when it spills into a second 64-byte block. The length is stored as a 64-bit little-endian bit count, not a byte count. This page's unit tests cover both the short sample and that eighty-digit sample.

md5sum and this page agree when they see the same bytes. They disagree when echo appends a newline, when an editor writes a UTF-8 BOM, or when one side hashes the archive and the other hashes a file inside it. The comparison line saying no match is the page refusing to call those equal. Look at the file size the publisher listed. A mismatch of even one byte is a different MD5, which is what you want from a checksum.

printf '%s' abc | md5sum
openssl dgst -md5 archive.zip
certutil -hashfile archive.zip MD5

Command-line equivalents

Linux prints the checksum with md5sum. The line is the hex, two spaces, and the name of the file. BSD and macOS often use md5, which prints MD5 (filename) = hex. OpenSSL prints MD5(filename)= hex. The Windows command is certutil -hashfile archive.zip MD5. All of them are the same 128-bit function. Copy the 32 hex characters. You do not need to strip spaces first, because the comparison on this page drops whitespace before it compares hex.

Hash the file the mirror told you to hash. If the instructions say md5sum archive.zip, select archive.zip in the file control. If they say the checksum of the uncompressed ISO, unzipping first is required, and hashing the zip will not match. Text mode on an old FTP transfer can also rewrite line endings and change the checksum of a README while leaving a binary payload alone.

Security notes

MD5 is fit for accidental-change detection when you already trust the checksum's source and you are not defending against someone who crafts collisions. It is not fit for signatures, certificates, password storage, or cache keys that an untrusted user can influence. Password storage needs Argon2, bcrypt, or scrypt. Those functions are slow on purpose and they store a salt. An MD5 of a password is recoverable with widely available wordlists. Do not paste a password here to see what the hash looks like. The algorithm is the wrong one even before you think about where the text sits.

If you are choosing a checksum for a new download page, prefer SHA-256 or SHA-512. Keep MD5 only when an old installer already checks it and you cannot change the installer. Publishing both an MD5 and a SHA-256 is reasonable during a transition, as long as the instructions tell people to prefer the longer digest. A collision that satisfies MD5 will not satisfy SHA-256. This page will not upgrade an MD5 to SHA-256 for you. Those are different strings, and the SHA-256 generator is the place to compute the replacement.

Rules and limitations

The text area is UTF-8. The file control reads bytes, up to 32 MB, and overrides the text area. An empty text area with no file is the empty message, digest d41d8cd98f00b204e9800998ecf8427e, not an error. Hex comparison is case-insensitive and ignores spaces. Base64 comparison is exact.

Letter case is a hex display option. It does not change which 16 bytes were computed. The filename is not part of the input. MD5 here is the RFC 1321 function, not an HMAC and not a Unix crypt hash.

Common problems

No match against a published checksum is often a newline, a BOM, or the wrong file in a multi-file archive. It can also mean the publisher printed SHA-1 and labeled it loosely as a hash. Count characters. Thirty-two is MD5. Forty is SHA-1. Sixty-four is SHA-256.

Some 'MD5' fields in old applications are MD5 of a UTF-16 string. This page uses UTF-8 for text. A file of UTF-16 bytes can be selected directly if that is the message you need. Typing the characters into the text area will not recreate UTF-16.

Frequently asked questions

About this tool

Maintained by Toolbench. For large or deeply nested files, split the input into smaller batches and verify representative results before using them in an import or application. Report reproducible problems through Contact.