MD5 & CRC32
Legacy checksums for verifying downloads and old file listings.
About these checksums
Type text or choose a file and get both an MD5 hash and a CRC32 checksum. Files are read locally, so you can verify a download without handing it to anyone.
Both are legacy algorithms, still widely used for one specific job: checking that a file arrived intact. Plenty of software distributors still publish MD5 sums, and every ZIP archive stores a CRC32 for each entry.
Which one, and when
CRC32 is an error-detecting code, not a hash. It is extremely fast and catches accidental corruption โ a flipped bit, a truncated transfer, a bad sector. It offers no protection against deliberate tampering: producing a different file with the same CRC32 is trivial.
MD5 is a real cryptographic hash, but a broken one. Practical collisions have existed since 2004, and researchers have demonstrated things like two different certificates sharing an MD5. It remains fine for verifying a download against a published sum, or for de-duplicating files where nobody is trying to deceive you.
For anything where an attacker might be involved, use SHA-256. And neither belongs anywhere near password storage โ both are far too fast, which is precisely wrong when someone is guessing billions of candidates a second.
Frequently asked questions
How do I check an MD5 checksum of a file?
Choose the file above and compare the MD5 shown with the one the publisher listed. If they match character for character, the file arrived intact.
Is MD5 still safe to use?
For detecting accidental corruption, yes. For security, no โ collisions have been practical since 2004, so two different files can be made to share an MD5. Use SHA-256 where it matters.
What is the difference between MD5 and CRC32?
CRC32 is an error-detecting checksum: fast, 8 hex characters, and easily forged. MD5 is a 128-bit hash: slower, 32 hex characters, and broken for security but far stronger against accidental collisions.
Is my file uploaded to hash it?
No. It is read into memory by your browser and hashed locally. Nothing is transmitted.