What Is MD5?
MD5 (Message Digest Algorithm 5) was designed by Ronald Rivest in 1991 as a successor to MD4. It produces a 128-bit digest, rendered as 32 hexadecimal characters. It was widely adopted throughout the 1990s for password storage, digital signatures, and file verification.
The Collision Problem
MD5's first practical collision was demonstrated by Wang and Yu in 2004. By 2008, researchers had created a rogue SSL certificate using MD5 collision attacks — a real-world demonstration that MD5 was unsuitable for security-critical applications.
MD5 is considered cryptographically broken for applications that require collision resistance: digital signatures, certificate authorities, and password hashing.
What MD5 Is Still Good For
Despite being cryptographically broken, MD5 remains useful for non-security applications:
File integrity checking in trusted contexts. If you download a file from a server you control and want to verify it arrived intact (not that it wasn't tampered with by a malicious actor), MD5 is fast and sufficient. Corruption in transit has a different character than intentional tampering.
Cache keys and content hashing. Many systems use MD5 to generate cache keys from content, since collisions in this context are extremely unlikely in practice even though they are theoretically possible.
Database deduplication. Finding duplicate records by comparing MD5 digests of their content is a common database pattern.
Checksums for software packages. Some package registries still publish MD5 checksums alongside SHA-256. For download verification where you trust the registry, MD5 is sufficient.
What MD5 Must Not Be Used For
- Password storage. MD5 is extremely fast, allowing attackers to compute billions of guesses per second. Even with a salt, MD5-hashed passwords are crackable with modern hardware. Use bcrypt, Argon2, or scrypt.
- Digital signatures. Collision attacks make it possible to produce two documents with the same MD5 hash.
- TLS/SSL certificates. Deprecated and rejected by all modern browsers.
Speed vs. Security Trade-off
MD5 processes data at roughly 330 MB/s on modern hardware (a single CPU core). SHA-256 is slower at around 120–200 MB/s, and bcrypt is intentionally orders of magnitude slower. The speed that makes MD5 unsuitable for passwords makes it useful for large-file checksums.
Try It
The MD5 tool on Syntaxly generates MD5 checksums in your browser. Input is never sent to a server.