MD5 has been cryptographically broken for over twenty years, and it is still everywhere: in package manifests, database columns, ETag headers and more login systems than anyone wants to admit. The interesting question is not whether it is broken, which is settled, but which of its uses the break actually affects.
What Broke, and When
MD5 was published by Ron Rivest in 1992 and produces a 128-bit hash. Weaknesses appeared almost immediately, and the timeline from theory to practical attack is worth knowing because it is unusually well documented.
1996: Hans Dobbertin found collisions in MD5's compression function, and cryptographers began recommending against it for new designs.
2004: Xiaoyun Wang's team demonstrated full collisions, two different inputs producing the same hash, computable in hours. This is the moment MD5 stopped being a cryptographic hash in any meaningful sense.
2008: Researchers used a chosen-prefix collision to obtain a rogue certificate authority certificate, which would have allowed them to issue trusted certificates for any website. This was a demonstration, but it worked against the real certificate infrastructure of the time.
2012: The Flame malware used an MD5 chosen-prefix collision to forge a Microsoft code-signing certificate, letting it present itself as a legitimate Windows update. That was not a demonstration.
Today a collision takes seconds on a laptop. Chosen-prefix collisions, the more dangerous kind, take hours on modest hardware.
Which Property Failed Matters
MD5 lost collision resistance. It has not lost preimage resistance, and that distinction determines whether a given use is still safe.
Collision resistance is the inability to find *any* two inputs with the same hash. This is what broke. An attacker who controls both inputs can construct a matched pair, which is exactly what forging a certificate requires: you build a benign document and a malicious one that share a hash, get the benign one signed, then attach the signature to the other.
Preimage resistance is the inability to find an input matching a hash you were *given*. No practical preimage attack on MD5 exists. Taking an arbitrary MD5 hash and finding text that produces it remains computationally infeasible.
So the question to ask of any MD5 usage is simple: can an attacker choose both inputs? If yes, MD5 is unsafe. If the input is fixed and outside their control, the break does not apply.
That said, preimage resistance offers no protection when the input space is small. MD5 rainbow tables cover essentially every password under about ten characters, which is why MD5-hashed password databases fall in minutes.
Where MD5 Is and Is Not Acceptable
The dividing line is whether an adversary can influence the input.
| Use | Verdict | Reason |
|---|---|---|
| Detecting accidental file corruption | Acceptable | Random corruption will not produce a collision |
| Cache keys and ETags | Acceptable | Inputs are yours; collisions are not attacker-controlled |
| Deduplicating your own files | Acceptable | No adversary; speed is the priority |
| Verifying a download against tampering | Unsafe | An attacker who alters the file can craft a collision |
| Code signing or certificates | Unsafe | This is precisely what Flame exploited |
| Password storage | Unsafe | Fast hash plus rainbow tables; use Argon2id or bcrypt |
| HMAC-MD5 | Deprecated but not broken | The key defeats collision attacks; still replace it |
| Git object naming | Not applicable | Git uses SHA-1, itself now being replaced by SHA-256 |
The download checksum illusion
An MD5 checksum published next to a download protects against a truncated transfer or a corrupted mirror. It does not protect against an attacker who compromised the server, because they can replace the file and the checksum together, or craft a file that matches the original hash. For tamper protection you need a signature, not a checksum.
Replacing MD5 Without Breaking Things
Most MD5 in production is not a decision anyone made; it is a default from a previous decade. Replacing it is usually mechanical.
For integrity checks, use SHA-256
Drop-in replacement in every language and standard library. It is slower than MD5, but for file verification the difference is irrelevant next to disk I/O.
For passwords, migrate on next login
You cannot recompute a stronger hash from a stored MD5. Verify against the old hash at login, then immediately rehash the plaintext with Argon2id and store that. Old hashes drain away as users return.
For HMAC, move to HMAC-SHA256
HMAC-MD5 is not currently broken because the secret key blocks collision construction, but it is deprecated in most standards and there is no reason to keep it.
For cache keys, leave it alone
If MD5 is generating internal cache keys from inputs you control, replacing it buys nothing. Spend the effort where an adversary is actually present.
Generate an MD5 hash
For checksums and legacy compatibility. Computed in your browser.
Why It Refuses to Disappear
MD5 is fast, its output is short, and it is implemented in every language without a dependency. For non-adversarial work those are real advantages, and the 128-bit output is half the length of SHA-256, which matters when you are storing billions of them.
The risk is not that MD5 exists. It is that people see it in a legitimate context, such as a cache key, and conclude it is fine generally. The same function then shows up guarding something that matters.
A reasonable policy for a codebase: allow MD5 only where a comment explains why the input cannot be attacker-controlled, and default to SHA-256 everywhere else. New code should have to justify choosing MD5, rather than justify avoiding it.
Frequently Asked Questions
Related Tools
Keep Reading
SHA-256 Explained: What Hashes Guarantee and What They Do Not
Three properties make a hash cryptographic, and each one supports a different use. Why SHA-256 is the wrong tool for storing passwords.
Password Strength: Why Length Beats Complexity Rules
NIST withdrew the advice about symbols and 90-day expiry, and the arithmetic explains why. One extra character is worth more than every symbol on the keyboard.
Base64 Is Not Encryption: What It Does and Why It Exists
Three bytes become four characters, which is where the 33 percent size increase and the trailing equals signs come from. And why it hides nothing.
JSON Errors Explained: Trailing Commas, NaN and Other Rejections
Why valid-looking JSON fails to parse, how to read a parser's error position, and the number precision bug that silently corrupts large IDs.