Is MD5 secure in 2026?

No. MD5 is broken and must not be used for anything security-relevant. Collision attacks since 2004 (Wang & Yu). Chosen-prefix collisions in hours (HashClash, 2009). Used to forge a Microsoft code-signing cert (Flame, 2012). Rainbow-table recovery for short / common inputs in seconds.

What is MD5 used for?

Non-security checksums (detecting accidental file corruption). Cache keys / fingerprinting where collisions don't matter.

How long is the output of MD5?

128 bits, which is 16 bytes, or 32 characters when written as hexadecimal. The length is fixed regardless of how large the input is.

Can MD5 be used to hash passwords?

No, and this is the most consequential mistake people make with it. MD5 is a fast general-purpose hash, and fast is exactly the wrong property for passwords: it lets an attacker with a stolen database test billions of guesses. Use a purpose-built password hashing function such as Argon2id instead.

Ronald Rivest, published in 1992.

Hash Lab

brokenMD · 128 bits · 1992

MD5

The world's most famous hash function, still everywhere despite being completely broken for security purposes since 2004.

By Deepak Gupta · Last updated May 28, 2026

MD5 (Message-Digest Algorithm 5) was the workhorse hash of the 1990s and early 2000s. It produces a 128-bit fingerprint, it's fast, and it's still the right answer when you need a checksum to detect *accidental* corruption: package managers, file-deduplication, internal cache keys. It is the wrong answer for *anything* security-sensitive: collisions can be generated in seconds on a laptop, chosen-prefix collisions in hours on a GPU, and the Flame malware used an MD5 chosen-prefix collision to forge a Microsoft code-signing certificate in 2012. If you're hashing passwords with MD5, an attacker with your dump can recover them in under a minute. Use BLAKE3 for fast non-cryptographic uses and Argon2id for passwords.

Recommended uses

·Non-security checksums (detecting accidental file corruption)
·Cache keys / fingerprinting where collisions don't matter

Known attacks / caveats

·Collision attacks since 2004 (Wang & Yu)
·Chosen-prefix collisions in hours (HashClash, 2009)
·Used to forge a Microsoft code-signing cert (Flame, 2012)
·Rainbow-table recovery for short / common inputs in seconds

Designed by

Ronald Rivest, published 1992.

Hash some text →Compare against other algorithms →

Frequently asked questions

Is MD5 secure in 2026?: No. MD5 is broken and must not be used for anything security-relevant. Collision attacks since 2004 (Wang & Yu). Chosen-prefix collisions in hours (HashClash, 2009). Used to forge a Microsoft code-signing cert (Flame, 2012). Rainbow-table recovery for short / common inputs in seconds.
What is MD5 used for?: Non-security checksums (detecting accidental file corruption). Cache keys / fingerprinting where collisions don't matter.
How long is the output of MD5?: 128 bits, which is 16 bytes, or 32 characters when written as hexadecimal. The length is fixed regardless of how large the input is.
Can MD5 be used to hash passwords?: No, and this is the most consequential mistake people make with it. MD5 is a fast general-purpose hash, and fast is exactly the wrong property for passwords: it lets an attacker with a stolen database test billions of guesses. Use a purpose-built password hashing function such as Argon2id instead.
Who created MD5?: Ronald Rivest, published in 1992.