MD5 & HMAC
Compute MD5 and HMAC-MD5 digests fully offline, with CJK text and arbitrary keys — handy for file fingerprints and legacy API signatures.
>_ USAGE GUIDE
Compute MD5 and HMAC-MD5 digests fully offline: plain MD5 for a straight fingerprint, HMAC mode with a key for signed values — the form you meet when integrating legacy payment callbacks and open-platform authentication. Chinese characters and arbitrary symbols are handled as UTF-8, the result outputs as a 32-character hex string, and one click copies it.
- Paste your text: the MD5 digest computes instantly as you type
- Add a key for HMAC: switch to HMAC mode and enter the shared secret to produce the keyed signature
- Copy and compare: paste the result into your verification flow or send it to the other system
The entire computation runs in your browser — passwords and keys never touch the network. One boundary worth repeating: MD5 is not appropriate for new security-sensitive designs. It lives here to serve existing system integrations and checksum-style needs, and for anything new, HMAC-SHA256 is the better default.
>_ FAQ
Q1 · Can MD5 be decrypted?
No. MD5 is a one-way hash — irreversible by construction. "MD5 decryption" sites simply look up the hashes of enormous collections of common strings (rainbow tables). Simple passwords can be "found" this way; complex ones cannot — which actually proves the lookup hit a weak password, not that MD5 was broken.
Q2 · What is a "32-character MD5"? Is there a 16-character version?
MD5 always outputs 128 bits, which in hex is 32 characters. A "16-character MD5" is just a truncation — the middle 16 characters (positions 9–24) — an older convention some legacy systems use. Both forms refer to the same digest; just confirm which one the other side expects before comparing.
Q3 · Is it safe to store user passwords as MD5?
No — modern standards have retired it. MD5 computes so fast that GPUs try billions of candidates per second, making simple passwords trivially vulnerable to rainbow tables and brute force. The correct approach is a slow, salted algorithm such as bcrypt, scrypt, or argon2. If you must keep MD5 for a legacy system, at least add a salt and plan the migration.
Q4 · How is HMAC-MD5 different from plain MD5?
Anyone can compute a plain MD5 of anything. HMAC is a keyed hash: without the shared secret, a signature cannot be forged. API authentication uses HMAC — both sides hold the key, the requester signs the parameters, and the server verifies with the same key. Even so, new integrations should prefer HMAC-SHA256; HMAC-MD5 is for talking to legacy endpoints.
Q5 · How do I verify the MD5 of a downloaded file?
This tool handles text; for whole files use the companion File Hash Checker — drop the file in, compute locally, and compare with the value published by the vendor. Note that MD5 collisions can be constructed deliberately, so for security-sensitive verification such as installers, prefer the published SHA-256.