Hashing · 128 bits, 32 hex characters
MD5
MD5 produces a 128-bit digest and is broken for security use.
Key facts
| Output | 128 bits, 32 hex characters |
|---|---|
| Block size | 512 bits |
| Standard | RFC 1321 |
| Collisions | Practical since 2004 |
| Status | Broken for security |
| Still used | Non-security checksums |
Fast and collision-prone
MD5 was designed for speed on 1990s hardware and became ubiquitous as a file checksum. Its 128-bit digest is short enough that collision attacks became practical; researchers demonstrated chosen-prefix collisions that let two different files share a digest.
A collision is not the same as a preimage attack. Finding an input that hashes to a specific value is still hard, but producing two related inputs with the same hash is not, and that is enough to forge signatures and certificates.
Where it still appears
MD5 remains in legacy protocols, cache keys and integrity checks where the threat is accidental corruption rather than an attacker. It is also used as a non-cryptographic identifier in some build systems. Those uses are acceptable only when no adversary controls the input.
Never use MD5 for password storage. A fast hash lets an attacker test billions of guesses per second, and the collision weakness is an additional problem. Use a password hashing algorithm instead.
Frequently asked questions
Is MD5 still safe for file checksums?
For accidental corruption, yes. For verifying a download against a malicious replace, no.
Can MD5 be salted for passwords?
A salt does not fix the speed problem. Use bcrypt, scrypt or Argon2id.