MD5 Hash Generator
About MD5 Hash Generator
Type anything and all four forms of the hash appear at once: 32 or 16 characters, upper or lower case. They are the same hash; the 16-character one is just the middle slice of the 32-character version, a habit from old systems that some integrations still expect.
MD5 turns any input into a fixed 128-bit fingerprint. Same text in, same hash out, every time. Change one letter and the whole hash changes.
Still reasonable uses
- Checking a downloaded file against a published checksum
- Cache keys and deduplication, where nobody is attacking you
- Integrations that simply require it
Uses to avoid
Passwords. MD5 is fast by design, and fast is exactly wrong for password hashing. GPU rigs test billions of candidates per second; the plaintext passwords in every leaked database you have read about were recovered that way. Use bcrypt or argon2 on the backend.
Signatures and tamper-proofing are out too. Collisions have been manufactured since 2004, which retired MD5 as a security function a long time ago.
About Chinese text
The hash runs over UTF-8 bytes, which is what Linux md5sum does, so results line up. But if one side encodes the same text in GBK, the hashes differ while the text looks identical. When a hash "doesn't match" for no visible reason, check the encoding first, then trailing whitespace, then whether the other system salts it.
Frequently asked questions
Is MD5 secure?
As a checksum or cache key, fine. As password hashing or a signature, no: collisions have been manufactured since 2004, and the speed that makes it convenient also makes it cheap to attack.
Why is there a 16-character version?
It is the middle 16 hex characters of the 32-character hash. Some old systems store only that slice. Nothing new should.
Why doesn't my hash match the other system?
Check three things in order: trailing whitespace or line breaks in the input, the character encoding (UTF-8 versus GBK for Chinese), and whether the other side salts the hash.
Do you keep the text I hash?
No. The hash is computed in your browser and nothing is sent or stored.