MD5 is not safe for passwords
MD5 is a fast checksum. That speed is why it fails as a password hash: a GPU can try billions of guesses per second against unsalted MD5.
What MD5 is for
Detecting accidental corruption (“did this download match the published checksum?”). Cache keys. Legacy protocols that still require it.
It is not encryption, and it is not a password hash.
Why passwords need something else
- No salt in a raw MD5(password): identical passwords share a hash; rainbow tables apply.
- Too fast: cheap to brute-force.
- Collision attacks exist for MD5, which matters for signatures and certificates (use SHA-256 there).
What to use instead
For passwords: bcrypt, scrypt, or Argon2id, with a unique salt per password. For htpasswd files, prefer bcrypt ($2y$).
For file integrity against accidental change: SHA-256. For integrity against an attacker, you also need a signature or a trusted channel for the checksum.
Questions
- Is salted MD5 OK?
- Better than plain MD5, still too fast. Prefer bcrypt or Argon2id.
- Is SHA-256 OK for passwords?
- A single SHA-256 is still fast. Password hashing needs a slow KDF (bcrypt, Argon2id), not a general-purpose digest.
- Can I “decrypt” an MD5?
- No. But common inputs are looked up in tables. That is guessing, not decryption.
See also
Related tool: MD5 hash generator. Runs in your browser; input is not uploaded.