MD5 Hash Generator

MD5 is broken: where it is still fine to use it, and where you must never

What MD5 is

MD5 maps input of any length to a fixed 128 bits (16 bytes), usually written as 32 hexadecimal characters. Its design goals were speed, a strong avalanche effect (change one bit of input and the output is unrecognizable), and even distribution across the output space.

It was once widely used for file verification, cache-key generation, deduplication, and — historically — password storage. Today its role demands a strict split: as a non-adversarial integrity check it still works; for any security purpose it has already failed. Treating those two as interchangeable is the expensive mistake.

Because the output is fixed width, MD5 is attractive precisely where its weakness lies: a constant-size fingerprint is easy to store in a fixed-width database column or compare in a lookup. That convenience is exactly why it spread into roles — like password storage — where a constant-size, fast digest is the wrong tool for the job.

Why MD5 is considered broken

• The collision attack was published in 2004. Wang Xiaoyun and colleagues showed how to construct MD5 collisions, dropping the effort from a theoretical 2⁶⁴ down to something practically achievable.
• A real attack landed in 2008. Researchers used an MD5 collision to forge a CA-signed intermediate certificate, proving that "two different documents sharing an MD5" was no longer a theoretical concern.
• The Flame malware in 2012 exploited an MD5 collision to forge a Microsoft code-signing certificate, letting it masquerade as a legitimate update inside target networks.
• Compute is no longer the bottleneck. Modern GPUs compute billions of MD5 hashes per second, which makes brute-force and dictionary attacks so cheap they are effectively free.

The takeaway: in any scenario where an adversary can submit data after you, MD5 is off the table. That includes certificates, code signing, software-distribution verification (when an attacker can swap the file), digital signatures, and protocol authentication.

The thread connecting all four failures is that MD5 was designed for integrity, not for adversarial settings. When the two ends of a check are cooperating, a collision never happens by accident and MD5 does its job. The moment an attacker gets to choose what gets hashed, the ability to manufacture two inputs with the same digest turns a checksum into a forgery tool. The 2008 and 2012 cases are not laboratory curiosities; they are real certificates that fooled real verification chains.

Where MD5 is still reasonable

• Post-download transfer verification. When a file comes from your own server, MD5 confirms it was not corrupted in transit. The caveat: this guards against accidental damage, not malicious replacement — the latter needs SHA-256 or a signature.
• Cache keys and deduplication. Squashing a long URL or text into a 32-character fingerprint is just a short handle, with no security involved; even a collision only produces a wrong cache hit, not a breach.
• Content fingerprints and chunk identifiers. Resume-download logic and content-addressed storage use it for fast comparison.
• Data partitioning and bloom filters. Places where you want speed and do not need collision resistance.

The dividing line is intent. A cache-key collision merely wastes a cache entry; a forged certificate compromises a trust chain. The same 128-bit digest is harmless in the first case and dangerous in the second, which is why the guidance is never "MD5 is bad" but "MD5 is bad wherever an adversary influences the input."

Where it must never appear

• Password storage. This is the most serious case. MD5 is fast, meaning an attacker can try billions of candidate passwords per second; add no salt and a single rainbow table cracks huge numbers of accounts at once. Passwords require a purpose-built slow hash — bcrypt, scrypt, or Argon2 — which have tunable compute and memory costs and a built-in random salt.
• Message integrity authentication. To stop tampering you need a keyed scheme — HMAC-SHA256 or a digital signature — not a bare hash.
• TLS certificates, code signing, software updates. These require SHA-256 or stronger.

Choosing among the family

One point often missed: a hash is not encryption. Hashing is irreversible and provides no confidentiality. Believing that running MD5 over sensitive data "anonymizes" it is wrong — for low-entropy data such as ID numbers or phone numbers, the search space is so small that a precomputed table reverses it instantly.

This tool computes entirely in the browser, so your input never leaves the device. It supports both uppercase and lowercase hex output.