MD5: 128 Bit Digests, Broken Collisions, and Remaining Uses

MD5 is a Merkle-Damgard hash: the message is padded, split into 512 bit blocks, and each block is mixed into a 128 bit chaining value through four rounds of 16 operations. The final chaining value is the digest, printed as 32 hex characters. It was designed in 1991 and it is very fast, which is exactly the property that later made it unsuitable for the jobs people kept giving it.

The break is specific. In 2004 Wang and Yu produced colliding message pairs; by 2009 chosen prefix collisions let an attacker take two arbitrary, different prefixes and append computed blocks so the two files hash identically. That is how the Flame malware forged a code signing certificate in 2012. What has never been demonstrated is a practical preimage attack: given a digest, nobody can produce an input that hashes to it, other than by guessing.

That distinction decides what MD5 can still do. Anywhere two parties might submit files, MD5 is finished: certificates, signatures, code integrity, deduplication of untrusted uploads, and any 'this file matches the one I approved' check. An attacker who supplies both files controls both sides of the collision, which is precisely the scenario a collision attack needs.

Anywhere the input is yours and nobody is trying to fool you, MD5 is merely old rather than dangerous. ETag generation, cache keys, sharding, detecting whether your own config file changed since the last deploy: these care about accidental collisions, which remain vanishingly unlikely at 128 bits. Even so, SHA-256 is fast enough on modern hardware that new code has no reason to reach for MD5.

MD5 is wrong for password storage, and this is the single most common misuse. It is fast by design, so a consumer GPU tests billions of candidates per second against a leaked MD5 table. Salting slows down precomputed rainbow tables and does nothing about raw throughput. Passwords need a memory-hard function with a tuned cost, such as Argon2id, scrypt or bcrypt. ToolBox does not provide one, and this generator is not a stand-in.