What MD5 does
MD5 (Message Digest Algorithm 5, 1992) produces a 128-bit (32 hex character) digest from any input, processing it in 512-bit blocks through a series of bitwise operations across 64 rounds. Like any hash function, a tiny change in input should produce a completely different output — and it does, which is exactly why MD5 remained useful for detecting accidental corruption for years even after its security weaknesses were known.
MD5("hello") = 5d41402abc4b2a76b9719d911017c592
The collision problem, dated precisely
Practical collision attacks against MD5 have existed since 2004, when researchers first demonstrated two different inputs producing an identical MD5 digest. Since then, the attacks have only gotten more practical and efficient — modern hardware can generate an MD5 collision in seconds. This is a fundamentally different class of weakness than "someone might eventually brute-force it": collision generation is fast and reliable enough that MD5 offers essentially no protection against a deliberate adversary crafting a malicious file that matches a legitimate one's hash.
Why MD5 still appears in tools and legacy systems
Speed and inertia — MD5 is fast to compute and deeply embedded in decades of existing tooling (some version control internals, legacy checksums, cache-key generation). None of this makes it appropriate for anything security-sensitive today; it persists mostly where nobody has prioritized replacing it, not because it remains a sound choice.
Where MD5 is still reasonable
- Non-adversarial deduplication — checking if two files are likely identical during a bulk file scan, where nobody is trying to construct a malicious match.
- Cache keys — generating a short, deterministic identifier from a larger input, where uniqueness matters more than collision-resistance against an attacker.
- Legacy compatibility — reading/verifying old systems that already use MD5, where migrating isn't immediately feasible.
Where MD5 must not be used
- Password storage — MD5 alone is both broken and too fast, a double failure for password hashing; see Password Hashing.
- Digital signatures or certificate fingerprints — a forged collision defeats the entire point of a signature.
- Software integrity verification — an attacker could substitute malicious code that still matches the published MD5 checksum.
Common mistakes
- Assuming MD5 is fine "because it's just a checksum." Whether it's fine depends entirely on whether an adversary might deliberately try to forge a matching file — for anything security-relevant, assume yes.
- Using MD5 for password hashing, combining two problems (broken collision resistance and dangerous speed) into one weak system.
- Not distinguishing "collision resistant" from "still produces different output for different input most of the time." MD5 does the latter fine; it's the former — resistance to deliberate collision construction — that's broken.
FAQ
Is MD5 completely useless now?
Not for every purpose — non-adversarial checksums and deduplication remain reasonable uses; anything where an attacker might benefit from forging a match (signatures, security checks, passwords) should use SHA-256 or better instead.
How long has MD5 collision generation been practical?
Since 2004, with efficiency improving substantially since — modern hardware can produce a colliding pair in seconds.
Can MD5 be used safely for password storage if combined with a strong salt?
No — the core issue for passwords is speed, not just collision resistance; a salt doesn't fix that. Use bcrypt, scrypt, or Argon2, which are deliberately slow.
Generate MD5 digests (and compare against SHA-256) with the Hash Generator — entirely in your browser.