Is MD5 Secure? What MD5 Is Still Good For (and What It Isn't)

The short answer

No, MD5 is not secure for anything where an attacker is involved. It should not be used to store passwords, sign documents or prove that a file has not been tampered with. MD5 is still acceptable as a non-security checksum: spotting accidental corruption, building cache keys, or matching a value that a legacy system already uses. You can generate MD5 for text with the MD5 Hash Generator, which also shows SHA-256 and other stronger hashes side by side.

What MD5 is

MD5 is a hash function published in 1992 (RFC 1321). It turns any input into a fixed 128-bit value, written as 32 hexadecimal characters. The same input always gives the same output, and a one-character change gives a completely different hash:

• password → 5f4dcc3b5aa765d61d8327deb882cf99
• Password → dc647eb65e6711e155375218212b3964

A good cryptographic hash should make two things practically impossible: finding the original input from the hash, and finding two different inputs with the same hash (a "collision"). MD5 fails the second test badly, and it is too fast to protect passwords against guessing.

Why MD5 is considered broken

Collisions can be made on purpose

The IETF's RFC 6151 (2011) states that MD5 "is no longer acceptable where collision resistance is required such as digital signatures". It notes that collisions can be found in about a minute on an ordinary 2006-era notebook, and that collision attacks have been used against X.509 certificates.

In practice this means someone can create two different files with the same MD5 hash. If you trust "the MD5 matches" as proof that a file is genuine, an attacker can give you a harmful file that matches.

It is far too fast for passwords

Password hashes need to be slow, so that an attacker who steals a database cannot test billions of guesses. MD5 was designed to be fast. The OWASP Password Storage Cheat Sheet groups MD5 and SHA-1 with algorithms "designed to be fast" and says fast hashes such as SHA-256 are also unsuitable for passwords.

Plain, unsalted MD5 is worse still: everyone who chose password gets exactly the same hash, so cracking one cracks them all.

Can MD5 be decrypted?

No. A hash is not encryption, so there is no key and nothing to decrypt. Websites that offer to "decrypt MD5" actually hash huge lists of likely inputs (common passwords, words, short strings) and look up whether your hash is in their list. If it is, they show the matching input.

That has two consequences:

• A hash of a common or short value is effectively readable by anyone. Hashing a phone number, PIN or common password with MD5 does not hide it.
• A hash of a long, random value cannot be reversed by these sites, but that is because the input was strong, not because MD5 is.

What MD5 is still fine for

MD5 is still widely used where nobody is trying to fool you:

• Detecting accidental corruption. If a file was damaged in transfer or on disk, its MD5 will almost certainly change. Many older download pages and backup tools list MD5 for this reason.
• Deduplication and cache keys. Grouping identical files or building a short key from a long URL, where a deliberate collision would cause no harm.
• Legacy compatibility. Some APIs, databases and file formats require an MD5 value. Use it to match them, not as a security control.
• Quick comparisons of text. Checking whether two copies of a long text are identical. See Why Does the Same Text Give a Different MD5 Hash? if they unexpectedly differ.

RFC 6151 also says there is no urgent need to remove HMAC-MD5 from existing protocols, because the known attacks do not make it practically weak as a message authentication code. For new designs it recommends alternatives such as HMAC-SHA256.

What to use instead

Job	Use instead of MD5
Storing passwords	Argon2id, then scrypt, bcrypt or PBKDF2 (OWASP order)
Verifying downloads against tampering	SHA-256 or stronger, ideally with a digital signature
Digital signatures and certificates	SHA-256 or another SHA-2 or SHA-3 hash
Message authentication	HMAC-SHA256
Non-security checksums	MD5 is acceptable; SHA-256 also works

What about SHA-1? It is also weak for collision resistance. NIST announced in December 2022 that SHA-1 should be phased out, with a deadline of 31 December 2030, and recommends moving to SHA-2 or SHA-3.

Hash sizes at a glance

Algorithm	Bits	Hex characters
MD5	128	32
SHA-1	160	40
SHA-256	256	64
SHA-512	512	128

The length of a hash tells you which algorithm probably produced it. A 32-character hex string is very likely MD5.

How to generate and compare hashes

Open the MD5 Hash Generator.

Paste your text into the box and click Generate Hashes.

You get MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for the same text. Hover over a row and click Copy.

Compare with the value you were given. Hashes are case-insensitive hex, so 5F4D... and 5f4d... are the same.

To check a downloaded file, compare its SHA-256 in the Hash file tab of the Hash Generator with the value published by the software maker. The step-by-step guide is How to Verify a File Checksum (SHA-256).

If your system still uses MD5 for passwords

Do not try to "upgrade" by hashing MD5 hashes with SHA-256; both are fast.

Move to a password hashing algorithm such as Argon2id or bcrypt, with a unique salt per user (these libraries handle salts for you).

Re-hash each password with the new algorithm the next time the user logs in successfully, or wrap the existing MD5 hashes in the new algorithm straight away and plan a full migration.

Encourage or require users to change passwords if the old database may have been exposed.

Key points

• MD5 is broken for collisions and too fast for passwords.
• It cannot be decrypted, but common inputs can be looked up.
• It is still fine for catching accidental errors and for legacy matching.
• For security, use SHA-256 or stronger, and a dedicated password hashing algorithm for passwords.