This tool produces the MD5 digest of any text — a 128-bit value shown as 32 hexadecimal characters — and updates it live as you type. It is implemented in pure JavaScript and runs entirely in your browser, so it is safe to use with private strings.
How it works
MD5 (RFC 1321) processes your text as UTF-8 bytes. It pads the message to a multiple of 512 bits, appends the original length, then runs four rounds of bitwise operations over 64 steps, mixing four 32-bit state words (A, B, C, D). The final state, output little-endian as hex, is the 128-bit digest. The same input bytes always yield the same hash.
MD5 is fast but cryptographically broken — collisions can be generated cheaply — so it must never be used for passwords or digital signatures. It remains useful as a quick checksum to detect accidental corruption or as a non-security content fingerprint.
Reference hashes
| Input | MD5 digest |
|---|---|
| (empty string) | d41d8cd98f00b204e9800998ecf8427e |
| hello | 5d41402abc4b2a76b9719d911017c592 |
| Hello | 8b1a9953c4611296a827abf8c47804d7 |
| hello world | 5eb63bbbe01eeed093cb22bb8f5acdc3 |
Notice that hello and Hello produce completely different digests despite differing by only a single character. This is the avalanche effect: a small input change flips roughly half the output bits. That property is exactly what makes MD5 a reliable change-detector for files and strings.
The empty-string hash d41d8cd98f00b204e9800998ecf8427e is a well-known constant used to verify that any MD5 implementation is working correctly — paste it into the tool and confirm the output matches.
When MD5 is appropriate
MD5 is the right choice when:
- Verifying file downloads — comparing an MD5 checksum listed by a download site against the file you received catches corruption in transit
- Deduplication — hashing file contents to detect duplicate files in a large collection, where the goal is finding identical files, not security
- Non-sensitive fingerprinting — generating a stable identifier for a piece of content where the ID does not need to be secret or forgery-proof
- Legacy system compatibility — some older protocols and databases store MD5 digests and cannot be easily migrated
MD5 is never appropriate for passwords (use bcrypt, Argon2, or scrypt), digital signatures, or anywhere an attacker could benefit from crafting a collision.
Why case and whitespace matter
Because MD5 encodes every byte of input, even invisible differences produce different digests:
helloandHellodiffer by one bit in the first characterhello(with a trailing space) differs fromhellohello\n(with a newline) differs from both
When comparing checksums, always make sure the source and destination text are byte-for-byte identical, including encoding, line endings, and trailing whitespace. Nothing is uploaded to any server; your text never leaves your device.