What this tool does
This MD5 generator computes the MD5 digest of whatever you type, live, as 32 hexadecimal characters. It also hashes a file you pick from your disk, and compares either result against the MD5 checksum a download page gave you. Think of it as an md5 hash online that never actually goes online: the algorithm runs as JavaScript inside this tab, so neither the text nor the file is sent anywhere.
Browsers leave MD5 out of their built-in crypto API on purpose, so the implementation here is a direct transcription of RFC 1321 — the four rounds of sixteen steps, the sine-derived constant table and the padding rule — checked against every test vector in the RFC's appendix.
How to use it
- Type or paste text into the input box. The digest updates on every keystroke, and even an empty
box has one:
d41d8cd98f00b204e9800998ecf8427e. - To hash a file instead, pick it with the file field. The file is read locally, and its MD5 appears underneath with its name and size.
- Paste a published md5 checksum into the comparison field to see whether it matches. You can
paste the whole line from a
.md5file, filename included. - Download saves a
.md5file in themd5sumformat, whichmd5sum -ccan verify later.
What MD5 is still good for
MD5 answers one question well: did these bytes change by accident? A download truncated by a flaky connection, a sector gone bad on an old drive, a file mangled by a text-mode FTP transfer — all of them produce a different digest, and MD5 spots them as reliably as anything newer. It is also quick, and it is everywhere: cloud storage ETags, package mirrors, backup tools and database row fingerprints still use it.
What it cannot do is survive someone trying to fool it. Since 2004, researchers have been able to build two different inputs with the same MD5, and today that takes seconds on a laptop. Forged certificates and malware that shares a digest with a harmless file have both happened in the wild. So the rule is simple: MD5 for catching accidents, never for passwords, signatures or proving that nobody tampered with a file.
Where MD5 stops being enough
Use MD5 when it is the only digest a download page offers and the risk you are checking for is an accident. The moment someone could gain from swapping the file, a matching MD5 proves nothing, and the check has to move to a digest that still resists deliberate collisions.
If a project publishes more than one digest, verify the stronger one. For SHA-256, SHA-1, SHA-384 and SHA-512, use the hash generator, which computes all four with the browser's own Web Crypto implementation and sets out the full comparison between MD5 and SHA-256.
When the digest does not match
A mismatch almost always means the input differs by a byte you cannot see. echo appends a
newline, editors add a final line break on save, and Windows tools may write \r\n where Unix
writes \n. Text encoding is the other trap: this page hashes UTF-8, so café is five bytes, not
four. For files, a mismatch after a complete download is worth taking seriously — fetch it again
from a different mirror before you open it.
Moving the digest around in another format? The Base64 encoder converts between representations, and the UUID generator is the right tool when you need a unique identifier rather than a fingerprint of some content.