MD5 Hash Generator

MD5 is the checksum algorithm printed on Linux ISO download pages, npm package integrity lines, and legacy databases that hashed passwords before bcrypt existed. Despite being retired for security-critical work, it remains the standard for file fingerprinting and cache-busting keys, meaning developers still need to generate one quickly without uploading anything to a server.

This generator computes MD5 from any text or hex byte input using a pure-JavaScript implementation of RFC 1321, running entirely in your browser. The digest appears instantly as you type. Switch between 32-character hex, 24-character Base64 and 22-character Base64URL output in one click.

Worked Example: Matching a Known RFC 1321 Vector

The page opens pre-filled with a sentence so you see a real digest immediately. To confirm the implementation against the RFC 1321 §A.5 test vectors, clear the input, switch to Hex bytes mode and paste 616263 (the ASCII bytes for abc). The output is 900150983cd24fb0d6963f7d28e17f72, the known RFC digest. Press Load Sample to cycle through different sentences and confirm the hash changes with every one.

What Each Option Controls

• Text mode encodes the input as UTF-8 before hashing. Characters outside ASCII occupy more than one byte (é is 2 bytes, 中 is 3), so the byte counter can exceed the character count.
• Hex bytes mode interprets the input as a hex string and hashes the raw bytes. Spaces between hex pairs are ignored. An odd digit count or a non-hex character shows the message “Invalid hex input — only 0-9 and a-f characters allowed, even number of digits.”
• Hex output is 32 lowercase characters, the format printed by md5sum and most checksum files.
• Base64 is 24 characters including two trailing == padding characters, used in HTTP headers and some database storage formats.
• Base64URL is 22 characters with + replaced by - and / by _, no padding. Safe for URLs and filenames without percent-encoding.

When Not to Use MD5

MD5 is cryptographically broken. Collisions (two different inputs that produce the same 128-bit digest) can be constructed in seconds on consumer hardware. Never use it to verify file integrity against a malicious actor, to store passwords even with a salt, or inside a digital signature scheme. For security-critical hashing use SHA-256 or SHA-512; for passwords use bcrypt or Argon2. MD5 is appropriate for non-security uses where collision resistance does not matter: cache keys, content-addressable filenames, legacy interoperability and checksum comparisons where you control both sides. The empty-string digest is always d41d8cd98f00b204e9800998ecf8427e; clear the input and the tool shows nothing rather than hashing an empty string silently.