MD5 Hash Generator

Why the same text can give different MD5 hashes

MD5 is computed from bytes, and bytes depend on the encoding. The word "hello" takes 12 bytes in UTF-8 and 6 bytes in windows-1251, so the hashes come out different: 8a669e9418750c81ab90ae159a8ec410 and 43a3f987a7af93811b7682e43ed0752a. If a hash does not match the one produced by another program, the encoding is usually the reason.

A second reason is invisible characters. A trailing space and a line break are bytes too, and they change the hash. The text here is taken exactly as entered: nothing is trimmed or replaced.

MD5 of a file

The file is read in chunks right in the browser, so its size is not limited. You can select several files at once, and each gets its own hash. This is how people verify a downloaded distribution against the checksum published on the developer's site.

MD5 is not suitable for passwords

MD5 is fast, and a dictionary attack runs at the same speed. Ready-made tables of billions of short strings are freely available, so a short password can be recovered from its hash in seconds. For storing passwords, use slow functions: bcrypt, scrypt, Argon2.

Back in 2004, researchers learned to find two different files with the same MD5 hash, and in 2008 this trick was used to forge a certificate authority's certificate. To verify a file's authenticity, use SHA-256 from the hash generator.

MD5 still works for two jobs: checking a downloaded file against the developer's checksum, and reading old formats where the hash type is fixed.