MD5 (Message Digest 5) is a 1991 hashing algorithm that turns any data into a 128-bit fingerprint. Output length is fixed — 32 hex characters or 22 Base64 characters. The hash cannot be reversed back to the source text.
MD5 is broken for cryptography: practical collisions exist since 2004. For passwords use bcrypt, scrypt or Argon2. For file integrity checks (checksum) MD5 is still fine — no adversary, and it reliably catches random errors.
MD5 is broken for cryptography
since 2004
collision: hash(A) === hash(B), where A ≠ B
In 2004 practical MD5 collisions were demonstrated. Since 2008 — attacks on PKI certificates. Do not use for signatures, TLS, passwords, authentication.
Still fine for checksums
OK
verifying file integrity during download
For random errors (network glitch, bad disk) MD5 is fine: no adversary involved. Used in rsync, git before 2005, Linux distributions alongside stronger SHA-256.
For passwords — bcrypt / Argon2 only
critical
MD5(password) === MD5(password) → rainbow table
MD5 is fast: billions of hashes per second on a GPU. Rainbow tables + brute-force crack passwords in minutes. Store passwords with bcrypt, scrypt or Argon2 (slow, salted).
For new projects use SHA-256 (de-facto standard) or BLAKE2 (faster). Both give a longer hash (64 hex chars vs 32) and have no known practical attacks.
04
Frequently asked questions
Type the text and the hash appears immediately as 32 hexadecimal characters. The same value is also offered in uppercase and in Base64, where it takes 22 characters. The result is deterministic: identical input always yields an identical hash, and changing one character changes the whole thing.
No. The hash is computed by a library running in your browser and the text never leaves the device. Open the page, disconnect from the network and it keeps working. For a tool people paste passwords and keys into, that is the main property rather than a footnote.
Not for anything with an adversary. Practical collision attacks — two different inputs sharing a hash — have existed since 2004 and have only become cheaper, which rules MD5 out for signatures, certificates and password storage. As a checksum against accidental corruption, where nobody is trying to fool you, it remains fine.
No. A hash function is one-way: the input is not stored anywhere in the output, so there is nothing to reverse. Sites offering to «decrypt» MD5 are looking your value up in a table of precomputed hashes, which is why a short or common password resolves instantly while an arbitrary long string never does.
Length and resistance. MD5 produces 128 bits, SHA-256 produces 256, and no practical collision attack is known against the latter. MD5 is faster, which helps when checksumming a large file and hurts when storing passwords, since speed makes brute force cheap. Anything security-related should use SHA-256.
Functions built to be slow: bcrypt, scrypt or Argon2. They deliberately consume time and memory, which makes large-scale guessing expensive, and they include a salt — random data that makes identical passwords hash differently, so one cracked account does not reveal the rest. General-purpose hashes are the wrong tool here.