Dev Tools, 7 tools

Converters, 4 tools

Text Tools, 5 tools

Color Tools, 2 tools

Generators, 3 tools

Image Tools, 4 tools

PDF Tools, 6 tools

Calculators, 4 tools

Open tools · 0

About

MD5 Hash Generator

Type or paste text and its MD5 hash appears as 32 hex characters, or drop a file of any size and it is hashed in your browser without being uploaded. MD5 is broken as a security measure but still common as a checksum, so paste the one you were given, or what md5sum or certutil printed, to see whether it matches.

What it does

  • Base64 gives the 24-character form that the Content-MD5 header and Amazon S3’s upload checks use.
  • A checksum is found in what was pasted around it: certutil’s three lines, an md5sum or BSD line, or a Get-FileHash row.
  • Text is hashed as its UTF-8 bytes, so ş and é give the MD5 that Python or PHP gives for the same string.
  • HMAC-MD5 with a key, for the older APIs and mail logins that still sign with it.
  • An S3 object uploaded in one piece, without KMS encryption, has its MD5 as its ETag, so a download can be checked against it.

How to use it

  1. Type the text, or drop the file.
  2. Copy the MD5, in hex or Base64.
  3. Paste the checksum you were given, file name and all, to compare.
  4. Tick HMAC and enter the key if the MD5 is meant to be keyed.

What it does not do

  • Security: two different files with one MD5 can be made in seconds, so a signature, a certificate or a password must not rest on it.
  • Undoing a hash: MD5 is one-way, and sites that “decrypt” it look the text up in tables of hashes worked out before.

Questions

Is MD5 still safe to use?

To check that a download arrived whole, yes: accidental damage changes the hash. To prove a file was not tampered with, no, since someone can build a second file with the same MD5. Ask for SHA-256 when the source offers it.

What is the MD5 of an empty file?

It is d41d8cd98f00b204e9800998ecf8427e. Seeing it means what was hashed was empty, often a download that failed before its first byte arrived.

Can I paste what certutil or Get-FileHash printed?

Yes, as it is. The three lines of certutil -hashfile setup.exe MD5 and the table row of Get-FileHash -Algorithm MD5 both work: the hash is found in either, capitals or not, and compared with yours.

Everything here runs in your browser. Nothing you type, paste or open is uploaded, and there is no account and no queue. How that works.

Often used with

More in Dev Tools

  • JSON Formatter: Format, validate, repair and explore JSON: tree view, sorted keys, and big numbers kept exactly.
  • Regex Tester: Test JavaScript regular expressions live: highlighted matches, capture groups, replace, and a plain-English explanation.
  • Unix Timestamp Converter: Turn Unix timestamps in seconds, milliseconds or nanoseconds into dates and back, many at once, with Excel, Windows and Discord times too.
  • JWT Decoder: Decode a JSON Web Token, read every claim and its dates, and verify the signature with a secret, a PEM or a key set, told why when it fails.
  • URL Encode & Decode: Percent-encode or decode text for a URL with the kinds of escaping told apart, and take a link apart: edit its query, strip its tracking, see its real host.
  • Cron Expression Parser: Read a cron expression in plain English, see its next runs in any time zone and what a clock change does to them, or build one; Unix, Spring, Quartz and EventBridge.

All toolsAbout utilbrewPrivacy