MD5 Hash Generator: Free Online Tool
MD5
Other hashes (browser Web Crypto)
MD5 is fine for checksums and cache keys — never use it for passwords.
FREE TOOL · NO SIGN-UP
This MD5 hash generator turns any text into its 32-character MD5 hash instantly, and also shows SHA-1, SHA-256 and SHA-512 hashes of the same text. You can hash a whole block of text at once or hash each line separately, and choose lowercase or uppercase hex. It is useful for checksums, cache keys, deduplication, test data and comparing values without storing the original. The hashing happens entirely in your browser, so the text you enter is never sent anywhere.
How to Use the MD5 Hash Generator
Type, choose two options, copy.
Step 1: Enter or paste your input
Type or paste text into the Text to hash box. Every character counts, including spaces, capital letters and line breaks, so “hello” and “hello ” give completely different hashes. Text is encoded as UTF-8 before hashing, which matches most programming languages and command-line tools. Clear empties the box.
Step 2: Choose your options
- Hash each line separately: gives one MD5 hash per line, followed by two spaces and the original line, in the same layout as the
md5sumcommand. Useful for hashing a list of emails, IDs or URLs in one go. - Uppercase hex: shows the hash in capital letters (5D41…) instead of lowercase (5d41…). Both mean the same thing; some systems just expect one style.
Step 3: Copy, download or apply the result
The MD5 hash appears as you type. Click Copy hash to copy it. In single-text mode, SHA-1, SHA-256 and SHA-512 hashes are listed below, each with its own Copy button. These use the browser’s built-in Web Crypto, which needs a secure (HTTPS) page and is not shown in per-line mode.
How the MD5 Algorithm Works
MD5 (Message Digest 5) is a hash function that turns any input into a fixed 128-bit value, usually written as 32 hexadecimal characters. It was designed by Ronald Rivest in 1991 and is defined in RFC 1321.
A hash function is one-way: it is easy to go from text to hash, but there is no formula to go back. The same input always gives the same hash, and a tiny change gives a completely different one:
| Input | MD5 |
|---|---|
| hello | 5d41402abc4b2a76b9719d911017c592 |
| Hello | 8b1a9953c4611296a827abf8c47804d7 |
| hello + line break | b1946ac92492d2347c6235b4d2611184 |
| (empty text) | d41d8cd98f00b204e9800998ecf8427e |
In simple terms, MD5 pads the input to a multiple of 512 bits, appends its length, then processes it in 512-bit blocks. Each block goes through 64 rounds of bitwise operations, additions and rotations that mix it into four 32-bit state values. After the last block, those four values together form the 128-bit hash.
Because the output is always 32 characters, a single word and an entire book both produce hashes of the same length.
Verifying Files With MD5 Checksums
An MD5 checksum is the MD5 hash of a file. Download sites publish them so you can check that a file arrived complete and unchanged. If your file’s hash matches the published one, the download is intact.
This tool hashes text, not files. To get a file’s MD5, use your system’s built-in commands:
- Windows:
certutil -hashfile filename.zip MD5 - macOS:
md5 filename.zip - Linux:
md5sum filename.zip
Then compare the result with the published checksum. The hashes must match exactly. A single different character means the file is different.
Where this tool helps is with text you need to hash: API signatures, test strings, config values, or checking what a hash of a known string should be. In per-line mode the output layout matches md5sum, which makes it easy to compare lists.
Remember that MD5 checksums detect accidental corruption well, but not deliberate tampering. An attacker who can change a file can also craft matching MD5 values in some cases. For security-sensitive downloads, use the SHA-256 checksum if the publisher provides one.
Why MD5 Is Unsafe for Passwords
MD5 should never be used to store passwords. There are three reasons.
It is extremely fast. Modern hardware can compute billions of MD5 hashes per second. An attacker who steals a database of MD5 password hashes can try huge numbers of guesses very quickly.
Precomputed tables exist. Common passwords and their MD5 hashes are listed in massive lookup databases and rainbow tables. Many MD5 password hashes can be “reversed” in seconds by looking them up. This is why people say MD5 can be decrypted. It cannot, technically, but weak inputs can be found.
It has known collisions. Researchers showed practical MD5 collisions, two different inputs with the same hash, in 2004, and attacks have only become easier. That breaks MD5 for digital signatures and certificates too.
For passwords, use a slow, salted password hashing algorithm designed for the job: Argon2, bcrypt, scrypt or PBKDF2. Most frameworks and CMS platforms, including WordPress, already do this for you. Do not hash passwords yourself with MD5 or plain SHA-256.
Also avoid typing real passwords into any online tool, even one that runs locally.
MD5 vs SHA-1 vs SHA-256
| MD5 | SHA-1 | SHA-256 | |
|---|---|---|---|
| Output size | 128 bits (32 hex) | 160 bits (40 hex) | 256 bits (64 hex) |
| Speed | Very fast | Fast | Fast |
| Collision resistance | Broken | Broken (practical collision shown in 2017) | No practical attacks known |
| Good for | Checksums, cache keys, deduplication | Legacy systems, Git object IDs | Security, signatures, file integrity |
| Passwords | No | No | No (use Argon2, bcrypt) |
This tool shows all of them, plus SHA-512, so you can pick the one your system needs. When you have a choice and security matters, use SHA-256 or stronger. When you just need a short, fast fingerprint for non-security purposes, MD5 is still fine.
Key Features of Our MD5 Hash Generator
- Free with no signup.
- Instant MD5 as you type.
- SHA-1, SHA-256 and SHA-512 for the same text.
- Per-line hashing in md5sum-style output.
- Uppercase or lowercase hex.
- UTF-8 encoding that matches common tools.
- Private: hashing runs in your browser.
Who Still Uses MD5
- Developers creating cache keys, ETags and short fingerprints.
- Data teams deduplicating records or hashing emails for matching.
- QA engineers generating predictable test values.
- Sysadmins checking legacy checksums.
- Marketers preparing hashed lists where a platform specifies MD5.
Pro Tips and Mistakes to Avoid
Checklist of best practices
- Normalize text first (trim spaces, lowercase emails) so hashes match.
- Use per-line mode for lists.
- Use SHA-256 for anything security related.
- Check whether the receiving system expects uppercase or lowercase.
Common mistakes and quick fixes
- Hash does not match another tool. Check for trailing spaces or a line break at the end. Clean the text with the Extra Spaces Remover.
- Different results for accented text. The other tool may not use UTF-8.
- Using MD5 for passwords. Switch to bcrypt or Argon2.
- SHA hashes missing. You are in per-line mode or not on HTTPS.
Hash Text the Right Way
Type your text above to get its MD5 and SHA hashes. Generate unique IDs with the UUID Generator, encode special characters with the HTML Entity Encoder Decoder, and escape strings with JSON Escape Unescape. Find every free tool in the FHSEO Hub tools directory.