MD5 Hash Generator Online - text and file checksum

What MD5 is and when it still makes sense

MD5 is a hash function designed by Ronald Rivest in 1991. It turns any input into a 128-bit fingerprint written as 32 hexadecimal characters. For security MD5 is broken, because two different files with the same MD5 can be created on purpose. As a quick check against accidental damage it still works and is widely used, for example on download mirrors, in backup and sync tools, or as the ETag Amazon S3 shows for many uploaded files.

How to generate an MD5 hash

Add text or a file

Type or paste text, or switch to File and drop the file on the page. The MD5 hash updates as you type.

Choose the format

Lowercase hex is what md5sum and most websites show. PowerShell prints uppercase HEX. Base64 is used, for example, by the Content-MD5 header.

Copy or compare

Copy the hash with one click, or paste the expected MD5 into the compare field to see whether it matches.

MD5 at a glance

An MD5 hash always has the same length. A 40-character string is SHA-1 and a 64-character one is SHA-256, not MD5.

Property	Value	What it means
Length	128 bits, 16 bytes	The same for any input, from an empty field to a file of many GB.
Hex	32 characters	For example, the MD5 of "hello" is `5d41402abc4b2a76b9719d911017c592`.
Base64	24 characters	Ends with `==`. The same hash as hex, only written differently.
Empty input	`d41d8cd9…`	If you get `d41d8cd98f00b204e9800998ecf8427e`, nothing was hashed. In scripts this usually means an empty variable or a file that did not load.
Good for	Checksums	Spotting a damaged download or copy, cache keys, finding duplicate files.
Not for	Security	Passwords, signatures or anything an attacker could change on purpose. Use SHA-256 there.

How to check an MD5 checksum

Some download sites, mirrors and older software still publish only an MD5 checksum. If it matches the MD5 of your file, the file arrived complete. If the site also lists SHA-256, check that one instead.

Find the MD5 checksum on the download page. It is often next to the link or in a file ending in .md5.
Switch the generator to File and choose the downloaded file.
Paste the checksum into Compare with a hash. A green message means the file is OK.

MD5 checksum on Windows, Mac and Linux

Windows 10 and 11, macOS and Linux can calculate MD5 without extra software. Replace file.iso with the name of your file.

Windows (PowerShell): Get-FileHash .\file.iso -Algorithm MD5
Windows (Command Prompt): certutil -hashfile file.iso MD5
macOS: md5 file.iso
Linux: md5sum file.iso
Linux, check against a .md5 file: md5sum -c file.iso.md5

MD5 with a salt or a key

Older systems sometimes expect MD5 with a salt, for example the salt written right before the text. To get the same result, type the salt and the text into the field together, in exactly the order the system uses. If the system uses HMAC-MD5, turn on HMAC with a secret key and enter the key. HMAC-MD5 is not practically broken, but for anything new choose HMAC-SHA256 on the SHA-256 hash generator.

Never store passwords as MD5

Lookup tables already contain the MD5 of billions of common and leaked passwords, and a graphics card tries billions more per second. A salt does not change that much. For passwords use Argon2id, bcrypt or scrypt. If you are moving away from an old database of MD5 passwords, hash each password again with one of them the next time its user logs in.

Related Tools

More tools for preparing, editing, and checking text.

SHA-256 Hash Generator

SHA-256 of text or a file, checksum check

Open

Hash Generator

MD5, SHA-256 and SHA-512 from text and files

Open

Password Generator

Secure passwords online

Open

Base64 Encoder/Decoder

Encode and decode Base64 strings

Open

FAQ

Can MD5 be decrypted?

No. MD5 is not encryption and the original text cannot be calculated back from the hash. "MD5 decrypt" sites search huge databases of hashes of known words and leaked passwords. They find "password123" in a second, but not a long or random input.

Is MD5 still safe to use?

As a checksum against accidental damage, yes: a broken download or a bad copy will almost certainly change the MD5. As protection against deliberate changes, no. Two different files with the same MD5 can be created on a laptop in seconds, so MD5 must not be used for signatures, certificates or passwords.

How long is an MD5 hash?

Always 128 bits, which is 16 bytes. Written in hex that is 32 characters, and in Base64 it is 24 characters ending with ==. The length does not depend on the input.

Should I check the MD5 or the SHA-256 of a download?

SHA-256, whenever the site publishes it. Both catch a damaged download, but only SHA-256 also guarantees that nobody swapped the file for a different one with the same checksum. You can calculate it on the SHA-256 hash generator.

Why is my MD5 different from the one on the website or in the terminal?

Usually because of an invisible character. echo "hello" | md5sum hashes "hello" plus a newline, so use echo -n or printf. Windows line breaks (CR LF), a trailing space or a different text encoding change the MD5 too. For a file, a different MD5 means the file itself is different.

What does d41d8cd98f00b204e9800998ecf8427e mean?

It is the MD5 of empty input. If it shows up in your logs, a database or a script, something hashed an empty string, for example an unset variable or a file that was not read.

Does uppercase or lowercase matter?

Not in hex. PowerShell prints MD5 in uppercase, md5sum and certutil in lowercase, and it is still the same hash. The compare field accepts both.

Is my text or file uploaded anywhere?

No. The MD5 is calculated in your browser and neither the text nor the file leaves your computer. The file is read in parts, so even files of several GB work.