How to use the MD5 Hash Generator
- Type or paste text, or switch to File and choose a file.
- Read the MD5 hash in the highlighted row and click Copy.
- To verify a checksum, paste it into Compare with a hash.
What is MD5?
MD5 turns any input into a 128-bit value, written as 32 hex characters, like 5eb63bbbe01eeed093cb22bb8f5acdc3 for hello world. The same input always gives the same hash, and the smallest change gives a completely different one, which makes MD5 handy for spotting changed or duplicate files.
MD5 is no longer safe for security: people can deliberately create two different files with the same MD5. Use it for checksums and caching, and SHA-256 for anything security-related.
Which hash should I use?
| Algorithm | Length | Use it for |
|---|---|---|
| MD5 | 128 bits (32 hex characters) | Checking downloads and finding duplicate files. Not secure: collisions can be made on purpose. |
| SHA-1 | 160 bits (40 hex) | Legacy systems and Git object IDs. Also broken for security. |
| SHA-256 | 256 bits (64 hex) | The safe default: checksums, signatures, blockchains, API request signing. |
| SHA-384 / SHA-512 | 384 / 512 bits | When a standard asks for them, or for extra margin. SHA-512 can be faster on 64-bit machines. |
Verify a download
Many sites publish a checksum next to a download. Switch to File, choose the file, and paste the published value into Compare with a hash. A green ✓ Match means your copy is identical to the original. The file is read in your browser and never uploaded, so this works for large and private files too.
HMAC
An HMAC mixes a secret key into the hash, so only someone who knows the key can produce the same value. APIs and webhooks, for example from Stripe, GitHub or Slack, sign requests with HMAC-SHA256. Type the secret into HMAC secret key and every hash becomes an HMAC.
Don't use these for passwords
MD5 and SHA hashes are designed to be fast, which makes guessing passwords fast too. Store passwords with a slow, salted algorithm such as Argon2, bcrypt or scrypt instead.
Frequently asked questions
What is the MD5 of an empty string?
d41d8cd98f00b204e9800998ecf8427e.
Can MD5 be decrypted?
No. It's a one-way hash, not encryption. Sites that “decrypt” MD5 just look up hashes of common words they've already calculated.
Is my text or file uploaded?
No. Hashes are calculated in your browser: SHA with its built-in Web Crypto, and MD5 with code that runs on the page. It even works offline.
Can a hash be reversed?
No. A hash is one-way. Short or common inputs can sometimes be found by guessing, which is why passwords need slow, salted hashing.
Why is my hash different from another tool's?
The input must match byte for byte. Check for a trailing newline or space, and whether the text is UTF-8. Files are hashed exactly as they are.
What's the difference between hex and Base64?
They're two ways of writing the same bytes. Hex uses 0–9 and a–f; Base64 is shorter. Most checksums are published in hex.