Submit text to calculate the hash on the server. MD5 is not encryption or suitable password protection; the 16-character result is only part of the full digest.
Submit a string and the page returns its MD5 digest as a 32-character hexadecimal value, together with the middle 16 characters that older systems use as a short identifier. The digest is calculated on the server, so the result is identical no matter which browser or device you use.
MD5 is a checksum, not encryption: the same input always produces the same 128-bit output, and there is no key to reverse it. It is still useful for comparing values and detecting accidental change, and no longer acceptable for anything that has to resist a deliberate attack.
MD5 is a 128-bit hash built from the Merkle-Damgard construction: the message is padded, split into 512-bit blocks, and each block is mixed into a running state over 64 rounds. The output is deterministic, fast, and avalanche-sensitive, so changing a single character changes roughly half the bits in the digest.
The design is broken for adversarial use. Research starting in 2004 produced practical collisions, and by 2008 researchers could create a pair of different documents with the same MD5 digest and an identical-looking prefix. A collision means an attacker can substitute one file or message for another while the checksum still matches.
Comparing a configuration value between two systems, keying a cache entry, detecting an accidental bit flip in a download, or matching a log line against a known digest are all reasonable uses, because the threat model is a mistake rather than an attacker choosing the input.
Hashing passwords, signing certificates, verifying software updates released by a third party, and any scheme where an attacker benefits from choosing the input are not. For passwords use bcrypt, scrypt or Argon2 with a per-user salt. For signatures use SHA-256 or better. For file integrity against a hostile source, SHA-256 is the minimum.
The full MD5 digest is 32 hexadecimal characters, which is 16 bytes. Some legacy applications, and several well-known web applications, truncate the digest to its middle 16 characters to save space in a fixed-width column, which is where the short form comes from.
A truncated digest has only 64 bits of output, so collisions are far easier to find, and two different inputs can share the same short value. If you are matching a value produced by an old system, use the short form only for that comparison and keep the full digest everywhere else.
Accepts a text string and outputs 32-character or 16-character uppercase/lowercase MD5 hexadecimal digests.
Compare configuration values or log entries; create legacy checksums for API or database records; verify a pasted value against a known MD5 digest.
The entered text is sent to VoriTools and hashed on the server, so do not submit secrets that should not leave the browser.
MD5 is not collision-resistant and is not encryption; use it only for non-security checksums, and the 16-character result is only a substring.
Not for security purposes. Collisions can be produced on demand, so MD5 must not be used for digital signatures, certificates, password storage or any comparison an attacker could influence. It remains fine as a fast checksum for detecting accidental corruption.
No. MD5 is fast, unsalted by default and collision-prone, which makes brute-force and rainbow-table attacks cheap. Use a password hashing function such as bcrypt, Argon2id or scrypt, which are deliberately slow and include a per-user salt.
Yes on this page: the digest is calculated server-side, so do not submit passwords, private keys, session tokens or personal data. If you need to hash something sensitive, use a local command-line tool such as md5sum or openssl dgst.
Almost always because of encoding. This page hashes the UTF-8 bytes of the input, while another tool may use UTF-16 or a local code page, and a trailing newline or a byte-order mark also changes the digest completely. Compare the byte sequence, not the visible characters.
Use the file checksum tool, which reads the file locally and computes file hashes without uploading the content. Pasting a whole file into this text field is neither practical nor safe for large files.
SHA-256 for integrity and signatures, SHA-1 only where an existing protocol forces it, and bcrypt, scrypt or Argon2id for passwords. For non-security checksums where speed matters, xxHash or CRC-32 are both faster and better suited.