Short answer: MD5 is not secure for anything where an attacker is involved. It’s fast and still handy for non-security checks, but treating it as a security tool is a real risk. Here’s the nuance.
Verify this against any other tool. We ran the single word
hellothrough our hash generator and got5d41402abc4b2a76b9719d911017c592for MD5. Runecho -n hello | md5sumon any machine and you will get the same 32 characters — which is exactly the problem. MD5 is fast, deterministic and universally implemented, so an attacker with a precomputed table looks that value up instantly. The same word gives SHA-2562cf24dba…938b9824, and that is not safer because it is longer but because it has no practical collision attack. For passwords neither is appropriate: you want a deliberately slow function like bcrypt or Argon2.
Why MD5 is considered broken
MD5 is vulnerable to collisions — two different inputs that produce the same hash — and these can be generated cheaply. That breaks any use where a hash is meant to prove something an attacker can’t fake. It’s also extremely fast, which makes brute-forcing hashed values easy.
What MD5 is still OK for
- Non-adversarial checksums — detecting accidental file corruption or as a cache/dedup key, where no attacker is trying to fool you.
- Quick fingerprints for internal, non-security purposes.
What NOT to use MD5 for
- Passwords — never. And not SHA-256 alone either. Passwords need a slow, salted algorithm like bcrypt, scrypt or Argon2. (Better yet, don’t roll your own — use your framework’s auth.)
- Digital signatures, certificates, integrity against tampering — use SHA-256 (SHA-2) or SHA-3.
For the full comparison, see MD5 vs SHA.
Try it yourself
- Hash generator — compute MD5, SHA-1, SHA-256 and more locally in your browser to compare.
- Need strong, random passwords instead of hashing your own? Password generator.
Bottom line: MD5 for accidental-error checksums, SHA-256 for integrity, and a dedicated password hash (bcrypt/Argon2) for credentials.
Every row below came out of our own hash generator, and every row is checkable with echo -n hello | md5sum on your own machine. That is the point — these are not values you have to take on trust. ␠ marks a trailing space.
| Input | MD5 |
|---|---|
hello | 5d41402abc4b2a76b9719d911017c592 |
Hello | 8b1a9953c4611296a827abf8c47804d7 |
hell0 | 73b43f17232b391b9123adf40c1b65dd |
hello␠ | f814893777bcc2295fff05f00e508da6 |
password | 5f4dcc3b5aa765d61d8327deb882cf99 |
How MD5 fell
MD5 didn’t break overnight — the cracks widened over two decades:
- 1991 — MD5 is published, producing a 128-bit (32 hex-character) digest.
- 1996 — the first serious weaknesses appear in its compression function.
- 2004-2005 — researchers generate full collisions in hours, then minutes.
- 2008 — a working rogue certificate authority is built on an MD5 collision.
- 2012 — the Flame malware forges a Microsoft code-signing certificate using an MD5 chosen-prefix collision.
The pattern is the lesson: once collisions are cheap, real-world attacks follow. SHA-1 went the same way — its first public collision landed in 2017 — which is why new work should use SHA-256 or better.
Choosing the right algorithm
| Algorithm | Output size | Status | Use it for |
|---|---|---|---|
| MD5 | 128-bit | collisions broken (cheap) | accidental-corruption checksums, cache keys |
| SHA-1 | 160-bit | collisions broken (2017) | legacy only — avoid for new work |
| SHA-256 (SHA-2) | 256-bit | secure | integrity, signatures, certificates |
| SHA-3 | 224-512-bit | secure | modern alternative to SHA-2 |
| bcrypt / scrypt / Argon2 | configurable | secure, slow by design | passwords |
Choosing a replacement is a choice of digest width, and one input makes the widths concrete. hello under SHA-256 is
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824and under SHA-512 it is
9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043That is 64 against 128 hex characters — 256 against 512 bits — for the same five-letter input. Neither is slower to compute in any way you will notice in a browser, so the practical rule is simple: SHA-256 unless something you must interoperate with asks for SHA-512. What you should not do is pick a wider digest and keep using it as a password hash; width is not slowness, and password storage needs slowness.
Verifying a checksum in practice
When a download page lists a hash, compute your own and compare:
# checks only that the file wasn't corrupted in transit
md5sum ubuntu.iso
# preferred whenever the source could be tampered with
sha256sum ubuntu.isoA matching MD5 tells you the bytes arrived intact; it does not prove nobody swapped the file, because a matching MD5 can be forged. For that assurance you want SHA-256 plus a signature.
Look at the fourth row. hello with one trailing space hashes to f814893777bcc2295fff05f00e508da6, which shares nothing with 5d41402abc4b2a76b9719d911017c592. Most “the checksum does not match” reports are exactly this and not corruption at all: an editor appended a newline, or a copy-paste picked up whitespace. And the last row is the whole case against MD5 for passwords in a single value — 5f4dcc3b5aa765d61d8327deb882cf99 is the MD5 of password, and it sits in every rainbow table ever published. Searching that string finds the plaintext instantly; no collision attack is required.
FAQ
Is MD5 encryption?
No. MD5 is a one-way hash — there is no key and nothing to “decrypt”. So-called MD5-decrypt sites are just databases of precomputed hashes.
Is salted MD5 safe for passwords?
No. A salt stops identical passwords sharing a hash and blocks rainbow tables, but MD5 is so fast that an attacker with your database can still try billions of guesses per second. Use a slow hash like bcrypt or Argon2 — see the strong password guide.
My download only offers an MD5 checksum — is it useless?
Not at all. It reliably catches a corrupted download. It just isn’t proof against a malicious swap; prefer SHA-256 and a signature when the source can’t be trusted.