Online MD5 hash

Legacy MD5 checksum—compatibility only, not for security.

About this online tool

hidevtool MD5 workbench digests UTF-8 text into a 128-bit fingerprint. Choose lowercase hex (32 characters) or Base64 output—results update as you type and stay in your browser.

Online MD5 hash capabilities

What MD5 is used for today

MD5 was once common for file checksums and legacy APIs. It is fast and produces a 128-bit digest. New security designs should use SHA-256 or stronger; keep MD5 for compatibility with old systems only.

Not for passwords or trust

  • MD5 is not collision-resistant—do not use for certificates, signatures, or password storage.
  • For passwords, use PBKDF2, bcrypt, or Argon2 with salt on this site’s other tools.
  • For integrity on new projects, prefer the SHA hash tool (SHA-256+).

Input & output

  1. Input is UTF-8 text (including Chinese and emoji), same as most language standard libraries.
  2. Hex output is 32 lowercase characters with no spaces.
  3. Base64 encodes the 16 raw digest bytes—match the encoding your API or script expects.

Matching other tools

  • Empty string MD5: d41d8cd98f00b204e9800998ecf8427e (hex).
  • Test vector "abc": 900150983cd24fb0d6963f7d28e17f72.
  • If results differ, check UTF-8 vs UTF-16, trailing newlines, or file/binary MD5 vs text.

Security tips

  1. 1Treat MD5 as a legacy checksum, not a security boundary.
  2. 2Do not use MD5 alone to verify downloads from untrusted sources—use SHA-256 where possible.
  3. 3Need a keyed digest? Use the HMAC tool with MD5 only when a spec requires it.

Common use cases

Legacy APIs & configs

Reproduce MD5 signatures required by old payment or game server docs.

Quick checksums

Compare a short string’s digest with mysql MD5(), PHP md5(), or similar.

Teaching & debugging

Verify your code matches known test vectors before integrating.

Frequently asked questions

Is MD5 secure?
No. Use SHA-256 or stronger for security. MD5 remains useful only for legacy compatibility.
Hex or Base64?
Hex is the usual human-readable form (32 chars). Base64 is the same 16-byte digest in a compact encoding—pick what your target system uses.
Does input include a trailing newline?
Exactly what you type is hashed. A line break at the end changes the digest—match how your other tool reads input.
Is text uploaded?
No. Hashing runs entirely in your browser.