Free Tool
MD5 Educational Demonstrator
MD5 was once the standard hash function of the internet. Today it is broken — researchers can create two different files with the same MD5 fingerprint — and it must never be used for security. This demonstrator shows you what MD5 does, how it was broken, and what replaced it. For learning only.
Educational demonstrator only — MD5 is broken for security. Never use MD5 to protect passwords, verify downloads that matter, or sign anything. It is here so you can see how a hash works and how one fails, not so you can rely on it.
What this tool does
MD5, designed in 1992, takes any input and produces a 128-bit fingerprint — 32 hexadecimal characters. For years it was used everywhere: checking file downloads, storing passwords, and signing data. It is fast, simple and deterministic, and the same input always gives the same fingerprint, just like a modern hash. That is why it is still a good teaching tool: what it does is exactly what SHA-256 does, in a smaller output, and the demonstrator on this page shows the same properties — the avalanche effect, the fixed-length output, the one-way design.
What makes MD5 different is that it is broken. In 2004 researchers showed how to find collisions — two different inputs with the same MD5 fingerprint — and by 2008 they could forge a security certificate that browsers trusted, by crafting two certificates whose MD5 fingerprints matched. A hash that allows collisions cannot be trusted for integrity or for signatures, because an attacker can replace the real file with a fake one that has the same fingerprint. That is why no security system should use MD5 today, and why this page is labelled a demonstrator, not a tool.
The demonstrator computes MD5 in your browser with a compact, self-contained implementation of the algorithm, and it self-tests against the published test vectors on load: the empty string must hash to d41d8cd98f00b204e9800998ecf8427e and abc to 900150983cd24fb0d6963f7d28e17f72. If either value is wrong, the page says so. Nothing you type is sent anywhere — the computation is local, and the page works offline once loaded.
Try it
Type text below and see its MD5 fingerprint. Then change one letter and watch the whole fingerprint change.
Waiting. Press Generate MD5 hash. The result is 32 hexadecimal characters.
Self-test: the implementation is checked against the published test vectors when you press the button.
How it works
MD5 processes your input in blocks of 512 bits, mixing each block into a 128-bit state through 64 rounds of operations drawn from four different functions. The state is four 32-bit numbers, and each round updates one of them using a piece of the input, a constant and a rotation. After all the blocks are processed, the four numbers are the fingerprint, written as 32 hexadecimal characters. The design is elegant and fast — and its weakness is in the details of those mixing functions, which turned out to allow collisions.
A collision is two different inputs with the same hash. For a 128-bit hash, pure chance says you would need to try about 2 to the power of 64 inputs to find one by luck — an impossible number. But MD5's structure has a flaw that lets an attacker construct a collision deliberately, far faster than chance. The first public collisions took hours on the computers of 2004; today they take seconds. Once collisions are cheap, an attacker can create a harmless file and a malicious file with the same fingerprint, get the harmless one signed or approved, and then swap in the malicious one.
That is why MD5 was retired from security use and replaced by the SHA-2 family — SHA-256 and SHA-512 — which have no known practical collisions. MD5 still appears in non-security places, such as checksums for detecting accidental corruption, where a collision would have to happen by chance rather than by design. Even there, most systems have moved on, because using a broken algorithm invites confusion about what it guarantees.
Limitations
This demonstrator is for learning only. Never use MD5 to store passwords, verify a download that matters, sign data, or make any security decision. A matching MD5 fingerprint proves nothing about a file's authenticity, because an attacker can forge a collision. If you need a hash for security, use SHA-256 — the generator on this site computes it in your browser.
- The implementation on this page is a compact, readable version of the algorithm, included so you can see how MD5 works. It is not optimised and it is not a security component.
- The self-test checks the implementation against published test vectors. Passing the test proves the code computes MD5 correctly; it does not make MD5 safe to use.
- Nothing you type is sent anywhere. The computation is local, and the page works offline once loaded.
Examples
Example 1 — abc. Hashing abc gives 900150983cd24fb0d6963f7d28e17f72. This is one of the published test vectors from the original MD5 specification, and any correct implementation in the world gives this value. Press Run the self-test to see it verified on this very page.
Example 2 — the empty string. Hashing nothing gives d41d8cd98f00b204e9800998ecf8427e, the other classic test vector. It is the first thing a test suite checks, because the empty input exercises the padding logic — the part of the algorithm that handles the end of the message.
Example 3 — the avalanche effect, and the break. Hash The quick brown fox jumps over the lazy dog, then change one letter and hash again: the two fingerprints look completely unrelated, exactly as a good hash should. MD5 has the avalanche effect and it has determinism — everything except collision resistance. That single missing property is what broke it, and it is the property that separates a teaching hash from a secure one.
Frequently asked questions
Is MD5 secure?
No. MD5 is broken for security use: researchers can create two different inputs with the same MD5 fingerprint (a collision). Never use it to store passwords, verify important downloads or sign data. Use SHA-256 instead.
What is a hash collision?
Two different inputs that produce the same hash fingerprint. For a secure hash, finding one by chance should be infeasible. MD5's structure allows attackers to construct collisions deliberately, which is why it can no longer be trusted.
Why is MD5 still taught if it is broken?
Because it is small, readable and historically important, and because seeing how it fails teaches what a secure hash must guarantee. Learning MD5 is learning what collision resistance means — by watching it break.
Can I use MD5 to check a download?
Not for anything that matters. A matching MD5 only shows the file was not accidentally corrupted; an attacker can forge a file with the same MD5. Use the SHA-256 value if the author publishes one.
What replaced MD5?
The SHA-2 family — SHA-256 and SHA-512 — and, more recently, SHA-3. They have no known practical collisions and are the standard choices for integrity checks, password-related work and signatures.