MD5 Checksum Calculator
Get the MD5 of any file without uploading it, then check it against the value you were given.
[1] SELECT FILE(S) TO HASH
One file, several, or two to compare.
[2] CHOOSE YOUR HASH FUNCTION
What an MD5 checksum is
An MD5 checksum is a 32-character code calculated from the contents of a file with the MD5 algorithm. The same file always gives the same checksum, and any change to it, even a single character, gives a completely different one. Publishers list MD5 checksums next to downloads so that you can check the file you received is byte for byte the one they published.
The classic test sentence shows how this behaves:
Adding one full stop changed every part of the value. That is what makes a checksum useful for spotting damage: a truncated download or a flipped bit cannot leave the MD5 unchanged by accident.
"MD5 checksum", "MD5 hash" and "MD5 digest" all name the same 32-character value; the word changes with the context, not the result. The hash value explainer covers the general idea and the vocabulary in more depth. Downloads sometimes come with a small .md5 file instead of a value on the page; open it in a text editor and the checksum is the first 32 characters of the line naming your file.
Reading the result
The tool prints the MD5 as 32 hexadecimal characters (0–9 and a–f), which encode 128 bits. Upper and lower case describe the same value. The rest of this page covers the practical side: where MD5 came from, how far you can trust it, and how to get the same value from the command line on any operating system.
Two values are worth recognising on sight. d41d8cd98f00b204e9800998ecf8427e is the MD5 of zero bytes: if you get it, the file you selected is empty, often a failed download saved under the right name. And any value that is not exactly 32 characters long is not an MD5 at all, so it came from another algorithm.
Where MD5 came from
Ronald Rivest designed MD5 at MIT in 1991 to replace MD4, whose weaknesses had started to show. The algorithm was published as RFC 1321 in April 1992 and became the default fingerprint of the 1990s internet: it was built into PGP, early TLS, software mirrors, package managers and countless backup tools.
Internally, MD5 pads the input and splits it into 512-bit blocks. Each block is mixed into a 128-bit internal state through four rounds of sixteen operations each, built from additions, bitwise functions and rotations. The state left after the last block is the digest. This layout, called a Merkle–Damgård construction, is shared with SHA-1 and SHA-2, which is why the three behave alike from the outside even though their security is very different.
How MD5 was broken: a short timeline
- ›1993: Bert den Boer and Antoon Bosselaers find a “pseudo-collision” in MD5's compression function. Not an attack on real files, but a first crack.
- ›1996: Hans Dobbertin produces a collision of the compression function, and cryptographers begin recommending a move away from MD5.
- ›2004: Xiaoyun Wang, Dengguo Feng, Xuejia Lai and Hongbo Yu publish the first full MD5 collisions: two different inputs with the same digest.
- ›2005: Arjen Lenstra, Xiaoyun Wang and Benne de Weger build two different X.509 certificates that share one MD5.
- ›2007: Marc Stevens, Lenstra and de Weger demonstrate chosen-prefix collisions, where each of the two colliding files can start with arbitrary content of the attacker's choosing.
- ›2008: a team including Alexander Sotirov and Marc Stevens uses a chosen-prefix collision to obtain a rogue certificate authority certificate that browsers of the time would have trusted.
- ›2011: RFC 6151 updates the security considerations for MD5 and advises against using it where collision resistance is needed, such as digital signatures.
- ›2012: the Flame espionage malware is found to have used an MD5 collision to forge a Microsoft code-signing certificate, letting it pose as a legitimate Windows component.
For a side-by-side view of what this means against SHA-256, see MD5 vs SHA-256.
What a collision does, and does not, let an attacker do
A collision attack lets someone who controls the input produce two files with the same MD5. The attacker prepares both, publishes the harmless one, gets it approved or signed, and later swaps in the other. That is exactly what happened with the forged certificates: the attacker shaped both documents from the start.
What nobody can do in practice is the opposite: take a file that someone else made and create a different file with the same MD5. That would be a second-preimage attack, and none is known to be practical against MD5. So an MD5 checksum still catches a download that was cut short, a disk that flipped a bit or a copy that went wrong, and it is reliable for that purpose.
The weakness matters when the person who produced the file could be the adversary, or when an attacker can influence the file before its checksum is published. Software releases, contracts, certificates and anything signed fall into that category, and for those you want SHA-256 or stronger.
Where MD5 is still a reasonable choice
- ›Transfer and backup checks. After copying a large folder to an external disk or a NAS, matching MD5 values on both sides tell you the copy is complete and undamaged.
- ›Legacy checksums. When a vendor, an archive or an old mirror only publishes MD5, computing MD5 is the only way to compare. Prefer a SHA-256 value if one is offered as well.
- ›Digital evidence, paired with SHA-256. Investigators and lawyers often record both values so that older procedures and newer ones are satisfied. The hash value certificate page explains that workflow.
- ›Non-security identifiers. Caches, deduplication indexes and some storage systems use MD5 as a quick content fingerprint; for objects uploaded in a single part, Amazon S3's ETag is often the object's MD5.
Avoid MD5 for passwords (it is far too fast to compute, so guesses are cheap), for signatures, and for any file where a third party could benefit from a swap. The algorithm guide covers the alternatives.
Getting the MD5 from the command line
The browser tool is the quickest route for a one-off check. When you need to script it or work on a server, every operating system has a built-in command. The output format differs between them, which is the source of many false “mismatch” reports.
Windows: certutil
certutil -hashfile "C:\Users\you\Downloads\setup.exe" MD5
certutil prints three lines: a header naming the file, the hash on its own line, and a completion message. Copy only the middle line. Beware that certutil -hashfile file without an algorithm name gives you SHA-1, not MD5, certutil accepts MD2, MD4, MD5, SHA1, SHA256, SHA384 and SHA512 as algorithm names.
Windows: PowerShell
Get-FileHash .\setup.exe -Algorithm MD5 | Format-List
Get-FileHash returns the digest in upper case and defaults to SHA-256, so the -Algorithm MD5 switch is required. Upper and lower case hex describe the same bytes, so an upper-case result still matches a lower-case published value.
macOS
md5 ~/Downloads/archive.zip md5 -q ~/Downloads/archive.zip
The default output reads MD5 (archive.zip) = …. The -q flag prints the bare digest, and -r switches to the “hash, then file name” layout used on Linux.
Linux
md5sum archive.zip
find photos -type f -exec md5sum {} + > photos.md5
md5sum -c photos.md5
The second line writes one line per file for a whole folder; the third re-reads every file later and prints OK or FAILED for each, which is a cheap way to confirm a backup is still intact months later. To do the same without a terminal, select the folder in the tool above and export the list as CSV.
When the MD5 doesn't match
- Check the length first. 40 characters means SHA-1, 64 means SHA-256: you are comparing two different algorithms, and they will never agree.
- Make sure you hashed the right thing. A checksum published for a .zip is the checksum of the archive, not of the files inside it once extracted.
- Look at what you pasted. Extra spaces, a line break, or the file name copied along with the hash all break a naive comparison. The verify box above trims spaces, ignores case and accepts a whole md5sum output line, reading the hash at its start.
- Consider the transfer. Text files moved through an old FTP client in ASCII mode, or through a Git checkout that rewrites line endings, really are different bytes and get a different MD5.
- Download once more. If the mismatch persists across fresh downloads from the official source, tell the publisher rather than using the file.
MD5 questions
Who created MD5, and when?
Ronald Rivest of MIT designed MD5 in 1991 as a stronger successor to his earlier MD4. It was published as RFC 1321 in April 1992, which is still the reference specification.
Why do evidence and forensic forms still ask for an MD5 value?
Many forensic tools, procedures and court forms were written when MD5 was the standard, and an MD5 value is short enough to copy onto paper. Current practice is to record SHA-256 next to it, so that the record does not rest on a broken algorithm. The MD5 + SHA-256 option in the tool above produces both from one read of the file.
Is MD5 a form of encryption?
No. Encryption is reversible with a key; MD5 is a one-way digest with no key and nothing to decrypt. Websites that claim to “decrypt” MD5 only look the value up in a table of hashes of common words and passwords, which works for short guessable strings and never for a real file.
I hashed the same file with two programs and got different MD5 values. Why?
If both programs really read the same bytes, they cannot disagree. Look for a difference in the input instead: one of them hashed a text string you typed rather than the file, one hashed a copy whose line endings were converted, or one tool printed the value in a different format (upper case, spaces between bytes, or with the file name attached).
Will my file be uploaded to calculate the MD5?
No. This page reads the file locally and runs MD5 inside your browser through WebAssembly, so the contents of the file never leave your machine. You can check this in your browser's developer tools by watching the Network tab while the hash is calculated.