MD5 Hash Generator

16 chars, lowercase
16 chars, uppercase
32 chars, lowercase
32 chars, uppercase
Compute MD5 Clear

About MD5 Hash Generator

Type anything and all four forms of the hash appear at once: 32 or 16 characters, upper or lower case. They are the same hash; the 16-character one is just the middle slice of the 32-character version, a habit from old systems that some integrations still expect.

MD5 turns any input into a fixed 128-bit fingerprint. Same text in, same hash out, every time. Change one letter and the whole hash changes.

Still reasonable uses

  • Checking a downloaded file against a published checksum
  • Cache keys and deduplication, where nobody is attacking you
  • Integrations that simply require it

Uses to avoid

Passwords. MD5 is fast by design, and fast is exactly wrong for password hashing. GPU rigs test billions of candidates per second; the plaintext passwords in every leaked database you have read about were recovered that way. Use bcrypt or argon2 on the backend.

Signatures and tamper-proofing are out too. Collisions have been manufactured since 2004, which retired MD5 as a security function a long time ago.

About Chinese text

The hash runs over UTF-8 bytes, which is what Linux md5sum does, so results line up. But if one side encodes the same text in GBK, the hashes differ while the text looks identical. When a hash "doesn't match" for no visible reason, check the encoding first, then trailing whitespace, then whether the other system salts it.

Frequently asked questions

Is MD5 secure?

As a checksum or cache key, fine. As password hashing or a signature, no: collisions have been manufactured since 2004, and the speed that makes it convenient also makes it cheap to attack.

Why is there a 16-character version?

It is the middle 16 hex characters of the 32-character hash. Some old systems store only that slice. Nothing new should.

Why doesn't my hash match the other system?

Check three things in order: trailing whitespace or line breaks in the input, the character encoding (UTF-8 versus GBK for Chinese), and whether the other side salts the hash.

Do you keep the text I hash?

No. The hash is computed in your browser and nothing is sent or stored.

Related tools

Encoding View all ›