Hash generator · Guide
MD5 Hash Collision: How MD5 Broke and What to Use Instead
A collision is two different inputs producing the same hash. Every hash function has them in theory — there are more possible inputs than digests. What killed MD5 is that anyone can now produce a collision deliberately, cheaply, and on demand.
Accidental vs deliberate collisions
Accidental collisions in MD5 are still vanishingly rare. With 2^128 possible digests, the birthday bound puts a 50% chance of any random collision at roughly 2^64 hashed items — about 18 quintillion. You will not hit one by chance while deduplicating files.
Deliberate collisions are a different story. Since 2004, published techniques let an attacker construct two files with the same MD5 on ordinary hardware in seconds. That is the number that matters for security, and it is why MD5 is considered broken.
What a collision attack looks like in practice
Chosen-prefix collisions are the dangerous variant: an attacker picks two meaningfully different starting documents and appends computed padding so both end up with the same digest. Two contracts, two executables, two certificates — same fingerprint.
This was not theoretical. The Flame malware used an MD5 collision against a certificate authority to forge a code-signing certificate and pass as legitimate Microsoft-signed software.
Why your MD5 checksums may still be fine
A collision attack requires the attacker to control both inputs. If you are checking that a file you downloaded matches the file the publisher uploaded, and the checksum came over a channel the attacker cannot touch, MD5 detects corruption fine.
The failure mode is trusting an MD5 fingerprint as proof of identity or authorship. There, a second file with a matching digest is exactly what defeats you.
Migrating off MD5
For integrity and fingerprinting, move to SHA-256. It is universally supported, fast, and has no practical collision attack. SHA-1 is not a step up — it fell to a chosen-prefix collision in 2020.
For passwords, no general-purpose hash is the answer; use Argon2id or bcrypt. For keyed authentication, use HMAC-SHA256. If MD5 is embedded in a legacy protocol you cannot change, at minimum stop using it for anything an attacker benefits from forging.
Frequently asked questions
What is the probability of an MD5 collision?
By chance, negligible — about 50% only after hashing roughly 2^64 distinct inputs. Deliberately, near 100% in seconds, which is what makes MD5 unsafe.
Does a collision mean MD5 is useless?
Not for non-adversarial uses like cache keys or corruption detection. It is useless anywhere an attacker chooses the input.
Is SHA-1 a safe replacement?
No. SHA-1 has its own practical collision attacks. Go straight to SHA-256.
Ready to try it?
Open the free browser-based Hash generator and apply what you just read — no sign-up, runs locally.
Open the Hash generator tool