Md5 Encrypt & Decrypt

What is MD5 ?

MD5 (or Message Digest 5), is a cryptographic function that allows you to create a 128-bits (32 characters in hexadecimal since you only need 4 bits to code hexadecimal) "hash" from any input up to 2^64 bits. This produces a digital fingerprint of the file or text and thus allows to sign it for security verifications. MD5 was created in 1991 as a replacement of MD4 algorithm, that, however being a 128-bits algorithm too, suffered from security breaches (collisions were found very early). In 1996 actual collisions were also found on MD5 which is considered as insecure since then, collisions were confirmed in 2004. You can find out more about collisions here.

Despite being insecure, MD5 is still widely used as a file fingerprint (such as SHA-1) and password storage by webmasters that are not well informed about security.

The hash produced by MD5 is supposed to be unique (it cannot be since 128-bits even if very large is finite), so for instance if you type the word "Password" with a capital, it will produce this hash :

How to decrypt MD5 ?

Since MD5 in a hashing function, it is not reversible. Meaning that you cannot calculate the plaintext that was hashed only looking at the hash. It's a one-way function. Hash functions can compare data without retaining its original contents. Modern password systems should not use MD5, however: they use salted, deliberately slow password hashing functions.

Now if MD5 is a one way function, how do we decrypt it ? We actually don't "decrypt" MD5, we use this word because it's easy to understand, but hashing function cannot be decrypted. A possible plaintext can only be identified by calculating candidates and comparing their digests with the submitted value, or by finding a previously calculated match in a hash-to-plaintext database. This is what we have on this website. We have billions hashes stored in our database. When you enter a hash in our search bar, we look into our database if we have a match. If so we provide you with the password. Our database contains every dictionnary that we were able to find on the internet. We also made our own dictionnaries from statistical analysis of actual used passwords. We also bruteforce the unfound passwords every few weeks, so if your hash wasn't found, you can come back later maybe we'll have it cracked. If we are not able to crack it, you can still use paying bruteforce services such as hashes.com or onlinehascrack.com. Or if you have a good GPU, you can download hashcat and use it to crack MD5 hashes yourself.

Is MD5 secure?

No. MD5 is far too fast and has known collision weaknesses. It can still be useful for recognising a legacy digest or checking an old file when an MD5 value has already been published, but it should not be selected for new security signatures or password storage.

Passwords should be protected with a purpose-built password hashing algorithm such as Argon2id, scrypt or bcrypt. These schemes use a random per-password salt and an adjustable work factor. Do not invent a custom method for mixing a salt and password: home-grown cryptographic constructions are difficult to review and do not provide the protection of a recognised algorithm.

A separately protected pepper can provide an additional layer in some systems, but it does not replace an appropriate algorithm, secure key management or a migration plan for legacy hashes.

MD5 frequently asked questions

Statistics

We have found 46,800,520 hashes since 2015, with an overall match rate of 69.15%.