Hashing Files with MD5

MD5 file hashing computes a 128-bit fingerprint of a file's contents, producing a 32-character hexadecimal string. While MD5 is cryptographically broken for security purposes, it remains widely used for file hashing in non-adversarial contexts due to its speed and ubiquity.

Why MD5 is still used for files:

MD5 is faster than SHA-256, especially on hardware without SHA-NI extensions. For operations like deduplicating millions of files, building cache manifests, or generating ETags for HTTP caching, the speed difference matters. A 32-character MD5 string is also more compact than a 64-character SHA-256 string, saving storage in databases and reducing bandwidth in protocols that transmit many hashes.

Browser-based MD5 file hashing:

The Web Crypto API does not include MD5 (it was deliberately excluded as a deprecated algorithm). To hash files with MD5 in the browser, a JavaScript or WebAssembly implementation is needed. Libraries like SparkMD5 provide incremental MD5 hashing that can process files in chunks, enabling large file support without loading the entire file into memory. This tool uses such a library to compute MD5 hashes entirely in your browser.

The md5sum command:

On Linux, md5sum filename prints the MD5 hash. On macOS, use md5 filename or md5 -r filename for md5sum-compatible output. On Windows, use certutil -hashfile filename MD5. You can verify a manifest of hashes with md5sum -c MD5SUMS. Many FTP servers and download mirrors still publish MD5SUMS files alongside their content.

When MD5 file hashing is appropriate:

Use MD5 for detecting accidental corruption (bit rot in storage, truncated downloads), as a cache key or ETag, for content deduplication in storage systems, and for legacy system compatibility. Do not use MD5 when an attacker could substitute files (software distribution, security evidence). In those cases, use SHA-256 instead. When in doubt, use SHA-256; the performance difference is rarely significant for individual file hashing.