What MD5 is used for
MD5 turns any input into a 128-bit fingerprint, written as 32 hexadecimal characters. The same input always gives the same hash, and changing a single character changes the hash completely. That makes it a quick way to check that a download, a database row or a cache key has not changed, and many legacy systems, ETags and file listings still publish MD5 checksums.
MD5 is not secure any more. Researchers have produced colliding inputs (two different files with the same MD5) since 2004, so it must not be used to store passwords, sign documents or verify anything an attacker could tamper with. Use SHA-256 for those.
Worked example
The MD5 of The quick brown fox jumps over the lazy dog is 9e107d9d372bb6826bd81d3542a419d6. Change dog to cog and it becomes 1055d3e698d289f2af8663725127bd4b: no part of the old hash survives.
Why my checksum differs
Command-line tools hash the exact bytes of a file, including a trailing newline. echo "hi" | md5sum hashes hi\n, not hi. Use echo -n or printf to compare with this page.
How this works
The page encodes your text as UTF-8 and runs the MD5 algorithm from RFC 1321: the bytes are padded, the length is appended, and each 512-bit block passes through 64 steps that mix the data with fixed constants. The result is four 32-bit words written as 32 hexadecimal digits. The implementation is checked against the RFC 1321 test suite on every build. Web Crypto, the browser's built-in hashing API, does not offer MD5, so this page carries its own small implementation. Nothing is uploaded.
Frequently asked
Is MD5 safe for passwords?
No. MD5 is fast and has known collisions. Store passwords with a slow, salted algorithm such as Argon2, scrypt or bcrypt.
Can an MD5 hash be reversed?
Not mathematically, but short or common inputs can be found in lookup tables, which is another reason not to use it for secrets.
Why does my terminal give a different MD5?
It probably includes a trailing newline. Use echo -n or printf so only the text is hashed.
Does case matter in the hex output?
No. 9E10… and 9e10… are the same digest; choose whichever your system expects.
Sources
Reviewed Oct 17, 2026 · test vectors fixtures/dev/md5-hash/