MD5 Hash Generator

Paste or type any text, press Generate MD5 Hash, and you get the 32-character hexadecimal MD5 digest of that exact input, with a copy button. Tick Include salt and the tool hashes your text with the salt appended to the end of it (text + salt). A random 32-character hex salt is filled in when the page loads, and you can replace it with your own. The hash is computed in your browser; the text is never sent to a server.

MD5 is deterministic, so the same input always gives the same hash, here and in every other MD5 tool: "hello" is always 5d41402abc4b2a76b9719d911017c592. That's what makes it useful for checksums and lookups, and also why it's no longer used for passwords.

What you can set

• Text. Any length, including line breaks. Leading and trailing whitespace is part of the input, and a single changed character produces a completely different hash.
• Include salt. Off by default. When on, the salt in the field below is concatenated after your text before hashing. There is no option to prepend it or to apply multiple rounds.
• Salt value. Pre-filled with 16 random bytes as hex. Edit it freely; if you're matching a hash produced elsewhere, paste that system's salt here and check how that system ordered text and salt.

Worked examples

The "hello" and "Hello" rows show the avalanche effect: one bit of difference in the input changes about half the bits in the output. The empty-string hash is worth recognizing, since it shows up in logs whenever a program hashes a missing value by mistake.

What MD5 is good for now

MD5 was published by Ron Rivest in 1992 and produces a 128-bit digest. Collisions (two different inputs with the same hash) have been cheap to manufacture since 2004, and preimage attacks on password hashes are practical because MD5 is fast and enormous rainbow tables exist. So: don't use it to store passwords, sign documents or verify downloads against an attacker. It remains fine for jobs where nobody is trying to fool you.

• Checksums against accidental corruption.Comparing an MD5 before and after a file copy catches truncation and bit flips.
• Cache keys and deduplication. Hashing a URL or a record to a fixed 32-character key for a cache or a database index.
• Gravatar and legacy APIs. Gravatar looks up avatars by the MD5 of a lowercased, trimmed email address, and a number of older APIs still sign requests with MD5.
• Matching old database rows. If a legacy system stored MD5(password + salt), this tool with Include salt reproduces that value for testing a migration.

For anything security-related, use the SHA256 Hash Generator or the SHA512 Hash Generator, which take the same text-plus-optional-salt input, and for passwords use a purpose-built slow hash such as bcrypt or Argon2 rather than any of these. If you need to encode rather than hash (reversibly, for transport), that's the Base64 Generator. The SHA1 Hash Generator covers the other legacy digest you'll still meet in Git and old certificates. All of these are under all developer & test data tools.