What Is an MD5 Checksum?
A 32-character fingerprint of a file, used to check that a file arrived intact.
Definition
An MD5 checksum is a 32-character code calculated from the contents of a file with the MD5 algorithm, for example:
9e107d9d372bb6826bd81d3542a419d6
The same file always produces the same checksum, and any change to the file, even one character, produces a completely different one. Publishers list MD5 checksums next to downloads so you can check that the file you received is exactly the one they published. To get the MD5 checksum of a file, select it below.
[1] SELECT FILE(S) TO HASH
Select one or multiple files to hash from your system, or drag and drop files below. Pick two files to check whether they are identical.
[2] CHOOSE YOUR HASH FUNCTION
[3] LAUNCH THE HASHING PROCESS
Need to keep this file private? Encrypt it in your browser with CryptFile.Online, the sister tool — nothing is uploaded there either.
An example
The text The quick brown fox jumps over the lazy dog has this MD5 checksum:
9e107d9d372bb6826bd81d3542a419d6
Add a single full stop at the end and the checksum becomes:
e4d909c290d0fb1ca068ffaddf22cbd0
Nothing in the second value resembles the first. That is the point: you cannot tweak a file and keep its checksum by accident. An empty file always has the checksum d41d8cd98f00b204e9800998ecf8427e; if you see it, the file has no content.
Checksum, hash, digest: same thing?
For practical purposes, yes. Hash is the general term for the output of a hash function; digest is the cryptographer's word for the same thing; checksum is the word used when the purpose is checking integrity. An "MD5 checksum", an "MD5 hash" and an "MD5 digest" are the same 32-character value.
It is always 32 hexadecimal characters (0-9, a-f), representing 128 bits. Upper and lower case are the same value. A 40-character value is SHA-1, a 64-character one is SHA-256: different algorithms that cannot be compared with MD5.
How to check an MD5 checksum
Online: select the file in the tool above, calculate, and paste the published checksum into the verify box. It turns green on a match. The file is not uploaded.
Windows
certutil -hashfile download.iso MD5
or in PowerShell:
Get-FileHash download.iso -Algorithm MD5
macOS
md5 download.iso
Linux
md5sum download.iso
Publishers sometimes provide a .md5 file containing lines like 9e107d9d… download.iso. On Linux, md5sum -c download.iso.md5 checks every file listed in it.
Is MD5 still safe?
For detecting accidental damage (an interrupted download, a failing disk, a bad copy), yes: random corruption will not produce a matching MD5 checksum.
Against deliberate tampering, no. Since 2004 researchers have been able to create two different files with the same MD5 checksum, and the technique has been used in real attacks, notably by the Flame malware in 2012 to forge a Microsoft code-signing certificate. If someone could benefit from substituting a file, use SHA-256 instead. The MD5 vs SHA-256 page compares the two.
Why MD5 checksums are still everywhere
MD5 is fast, short, and supported by every tool ever written, so many download sites, backup tools, cloud storage services (as "ETag" values, for example) and legacy systems still publish or use it. If MD5 is what you have been given to compare against, MD5 is what you calculate: the MD5 calculator does that with nothing to install.
FAQ
Can an MD5 checksum be reversed to get the file back?
No. A checksum is 32 characters whatever the file size, so it cannot contain the file. Very short inputs, such as common passwords, can be looked up in precomputed tables, which is another reason MD5 is not used for passwords.
Why does my MD5 checksum not match the published one?
Usually the file is incomplete or a different version, or the published value is a SHA-1 or SHA-256 hash (count the characters: MD5 has 32). Download again and recheck. Upper or lower case does not matter.
Do two files with the same MD5 checksum have the same content?
Almost always, unless someone deliberately crafted a collision. For accidental differences MD5 is reliable; when tampering is a concern, compare SHA-256 hashes instead.
Does the file name affect the MD5 checksum?
No. Only the contents are hashed. Renaming or moving a file keeps its checksum.