MD5 Hash Collision: How MD5 Broke and What to Use Instead

Accidental vs deliberate collisions

Accidental collisions in MD5 are still vanishingly rare. With 2^128 possible digests, the birthday bound puts a 50% chance of any random collision at roughly 2^64 hashed items — about 18 quintillion. You will not hit one by chance while deduplicating files.

Deliberate collisions are a different story. Xiaoyun Wang and colleagues published the first MD5 collision in 2004, and later tools such as Marc Stevens' fastcoll produce a new identical-prefix collision, two inputs that differ only in a few computed blocks, in seconds on an ordinary computer. That figure, not 2^64, is the one that matters for security, and it is why MD5 is considered broken.

What a collision attack looks like in practice

Chosen-prefix collisions are the dangerous variant: an attacker picks two meaningfully different starting documents and appends computed data so both end up with the same digest. Two contracts, two executables or two certificates then share one fingerprint. They cost far more computation than identical-prefix collisions; the 2008 attack that forged a rogue certificate authority certificate ran on a cluster of about 200 PlayStation 3 consoles.

This was not theoretical. The Flame malware, discovered in 2012, used a chosen-prefix MD5 collision against a Microsoft certificate authority for Terminal Server licensing to obtain a code-signing certificate, and passed as legitimate Microsoft-signed software.

Why your MD5 checksums may still be fine

A collision attack requires the attacker to control both inputs. If you are checking that a file you downloaded matches the file the publisher uploaded, and the checksum came over a channel the attacker cannot touch, MD5 detects corruption fine.

The failure mode is trusting an MD5 fingerprint as proof of identity or authorship. There, a second file with a matching digest is exactly what defeats you.

Migrating off MD5

For integrity and fingerprinting, move to SHA-256. It is supported everywhere and has no practical collision attack. SHA-1 is not a step up: practical SHA-1 collisions have existed since 2017, and a chosen-prefix one since 2020.

For passwords, no general-purpose hash is the answer; use Argon2id or bcrypt. For keyed authentication, use HMAC-SHA256. If MD5 is embedded in a legacy protocol you cannot change, at minimum stop using it for anything an attacker benefits from forging.

Frequently asked questions

What is the probability of an MD5 collision?

By chance, negligible — about 50% only after hashing roughly 2^64 distinct inputs. Deliberately, near 100% in seconds, which is what makes MD5 unsafe.

Does a collision mean MD5 is useless?

Not for non-adversarial uses like cache keys or corruption detection. It is useless anywhere an attacker chooses the input.

Is SHA-1 a safe replacement?

No. SHA-1 has its own practical collision attacks. Go straight to SHA-256.