MD5 hash generator — checksums for text, not for passwords

How to use the MD5 hash generator

1. Type or paste into Text to hash. The hash updates as you type.
2. Leave Input is on Text (UTF-8), or switch to Hex bytes or Base64 bytes if you are hashing raw data.
3. Pick the Output style: lower-case hex, upper-case HEX or Base64.
4. To compute HMAC-MD5 instead, enter an HMAC key (optional).
5. Copy the 32-character result. The Input size line shows how many bytes were hashed.

What it does and when to use it

MD5 turns any input into a fixed 128-bit fingerprint, written as 32 hexadecimal characters. The same input always gives the same hash, and changing even one character gives a completely different one. That makes it handy for comparing two pieces of text, generating cache keys, matching a checksum listed next to an older download, or filling in an API or database field that was designed around MD5.

MD5 is not secure. Researchers showed practical collisions in 2004, meaning two different inputs can be crafted to share a hash. It must not be used for passwords, digital signatures, certificates or anything where an attacker could benefit from a forged match. The tool shows this warning under every result.

For new work that needs a secure fingerprint, use the SHA-256 hash generator. To compare two hashes without eyeballing them, use the hash compare tool.

How it works

Your text is turned into UTF-8 bytes (or decoded from hex or Base64). Those bytes are passed to the MD5 algorithm defined in RFC 1321, using the hash-wasm library, which runs as WebAssembly in your browser. MD5 pads the data, then processes it in 512-bit blocks through four rounds of mixing, ending with a 128-bit result. With a key, the tool computes HMAC-MD5 as described in RFC 2104. Nothing is uploaded.

Worked examples

All hashes below come from the tool and match the published test vectors.

The RFC 1321 test. The text abc gives 900150983cd24fb0d6963f7d28e17f72, the value listed in the MD5 specification.

One trailing space. abc (with a space at the end) gives 28a53e303da9f5742476fd6b62434540, completely different, and the input size changes from 3 to 4 bytes. This is the most common reason two hashes do not match.

HMAC-MD5. Text what do ya want for nothing? with the key Jefe gives 750c783e6ab0b503eaa86e310a5db738, matching the example in RFC 2104.

Limits and tips

• Case matters. Hello and hello give different hashes. Hex output, though, can be upper or lower case; both mean the same bytes.
• Line endings matter. Text copied from Windows may contain \r\n instead of \n, which changes the hash.
• For files, use the file hash checker rather than pasting file contents here.
• For passwords, use bcrypt, Argon2, scrypt or PBKDF2, never plain MD5 or MD5 with a salt. The bcrypt generator shows what a proper password hash looks like.