{"id":415,"date":"2021-05-25T09:27:06","date_gmt":"2021-05-25T07:27:06","guid":{"rendered":"https:\/\/infosecscout.com\/?p=415"},"modified":"2023-11-22T13:02:18","modified_gmt":"2023-11-22T12:02:18","slug":"is-md5-reversible","status":"publish","type":"post","link":"https:\/\/infosecscout.com\/is-md5-reversible\/","title":{"rendered":"Is MD5 Reversible? (Truth, Myths and Solutions)"},"content":{"rendered":"\n<p>This is a common question with cryptographic algorithms (MD5, SHA1, etc.). The security issues with these algorithms often come from a misunderstanding of what they are and how they work. In this article, we&#8217;ll especially look at the MD5 algorithm and if it can be decrypted or not.<\/p>\n\n\n\n<p><strong>As a general rule, the MD5 algorithm is not reversible, like most hashing functions. It hashes an unlimited set of values into a fixed digest of 32 hexadecimal characters. As several entries can have the same MD5 value, there are no algorithmic way to decrypt it.<\/strong><\/p>\n\n\n\n<p>Saying the MD5 algorithm is not reversible doesn&#8217;t mean it&#8217;s the perfect hash function and that there is no way to guess the original value, as we&#8217;ll see in this article. <\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_65 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title \" >Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/infosecscout.com\/is-md5-reversible\/#Is_MD5_Reversible\" title=\"Is MD5 Reversible?\">Is MD5 Reversible?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/infosecscout.com\/is-md5-reversible\/#How_the_MD5_algorithm_works\" title=\"How the MD5 algorithm works\">How the MD5 algorithm works<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/infosecscout.com\/is-md5-reversible\/#MD5_Encryption\" title=\"MD5 Encryption\">MD5 Encryption<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/infosecscout.com\/is-md5-reversible\/#The_myth_about_MD5_decryption\" title=\"The myth about MD5 decryption\">The myth about MD5 decryption<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/infosecscout.com\/is-md5-reversible\/#Why_the_MD5_hash_function_is_not_reversible\" title=\"Why the MD5 hash function is not reversible\">Why the MD5 hash function is not reversible<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/infosecscout.com\/is-md5-reversible\/#Is_there_any_Way_to_Decrypt_MD5\" title=\"Is there any Way to Decrypt MD5?\">Is there any Way to Decrypt MD5?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/infosecscout.com\/is-md5-reversible\/#Using_a_Database_to_Decrypt_MD5_hashes\" title=\"Using a Database to Decrypt MD5 hashes\">Using a Database to Decrypt MD5 hashes<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/infosecscout.com\/is-md5-reversible\/#Using_Brute_Force_against_MD5_hashes\" title=\"Using Brute Force against MD5 hashes\">Using Brute Force against MD5 hashes<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/infosecscout.com\/is-md5-reversible\/#Using_Online_Services_to_Crack_MD5_hashes\" title=\"Using Online Services to Crack MD5 hashes\">Using Online Services to Crack MD5 hashes<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Is_MD5_Reversible\"><\/span>Is MD5 Reversible?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>If you are reading this article, you probably need a quick reminder on how the MD5 algorithm works. So let&#8217;s start with this before seeing solutions to your problem.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_the_MD5_algorithm_works\"><\/span>How the MD5 algorithm works<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"MD5_Encryption\"><\/span>MD5 Encryption<span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<p><strong>The MD5 algorithm is a hashing function. It means that it generates a 32 hexadecimal characters string for any input it takes. You can convert a password, a paragraph or a whole encyclopedia to a MD5 hash from the same length.<\/strong><\/p>\n\n\n\n<p>For example, applying the MD5 function to the word &#8220;MD5Online&#8221; gives &#8220;d49019c7a78cdaac54250ac56d0eda8a&#8221; as a result.<\/p>\n\n\n\n<p>If you want to learn more on how the MD5 algorithm work, I recommend taking a course about it. I&#8217;ll not get into more depth here, but you can find great recommendation <a href=\"https:\/\/infosecscout.com\/hacking-resources\/\" data-type=\"page\" data-id=\"246\">on my resour<\/a><a rel=\"noreferrer noopener\" href=\"https:\/\/infosecscout.com\/hacking-resources\/\" data-type=\"page\" data-id=\"246\" target=\"_blank\">c<\/a><a href=\"https:\/\/infosecscout.com\/hacking-resources\/\" data-type=\"page\" data-id=\"246\">es pages<\/a>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_myth_about_MD5_decryption\"><\/span>The myth about MD5 decryption<span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<p><strong>It&#8217;s now common knowledge that the MD5 algorithm has many weak points, and that online websites like MD5Online are pretty good to get the original password from a MD5 hash.<br>But it doesn&#8217;t mean the MD5 algorithm is reversible or that we can decrypt any hash.<\/strong><\/p>\n\n\n\n<p>There are still some techniques we can use, as we&#8217;ll see in the next part.<br>One of the weaknesses of the MD5 algorithm we can use is that it always gives the same result for the same word.<br>So, we now know that &#8220;d49019c7a78cdaac54250ac56d0eda8a&#8221; is the MD5 hash for &#8220;MD5Online&#8221;.<br>If we find it somewhere, we can now &#8220;decrypt&#8221; it. That&#8217;s one solution used <a rel=\"noreferrer noopener\" href=\"https:\/\/md5online.org\" target=\"_blank\">in our tools<\/a>, but there are many other options.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Why_the_MD5_hash_function_is_not_reversible\"><\/span>Why the MD5 hash function is not reversible<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p><strong>Two MD5 entries can have the same MD5 hash as a result of the hashing function. In this case, there is no way to know which was the original string, even with a database. That&#8217;s why we can&#8217;t tell that the MD5 hash function is reversible.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-pullquote\"><blockquote><p>In computer science, a collision or clash is a situation that occurs when two distinct pieces of data have the same hash value<\/p><cite><a href=\"https:\/\/en.wikipedia.org\/wiki\/Hash_collision\" target=\"_blank\" rel=\"noreferrer noopener\">Wikipedia<\/a><\/cite><\/blockquote><\/figure>\n\n\n\n<p>If you want some examples of collision in the MD5 algorithm, <a rel=\"noreferrer noopener\" href=\"https:\/\/infosecscout.com\/two-files-with-same-md5-hash\/\" data-type=\"post\" data-id=\"402\" target=\"_blank\">you can read this article<\/a> where I go in more depth about this. Several researchers have proven this concept with both strings and files. So, there is no guarantee that the original entry is the same, even if the MD5 hash is identical. <\/p>\n\n\n\n<p>For those who want the technical answer, you can find on <a href=\"https:\/\/en.wikipedia.org\/wiki\/MD5\" target=\"_blank\" rel=\"noreferrer noopener\">the Wikipedia page<\/a> that the MD5 algorithm uses the modulo operation in its code. There is no way to reverse a modulo by knowing only the result.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Is_there_any_Way_to_Decrypt_MD5\"><\/span>Is there any Way to Decrypt MD5?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p><strong>As a whole, there is no ultimate solution to decrypt a MD5 hash 100% of the time. But techniques like brute force and database achieve a good success rate against short words hashed with the MD5 algorithm. <\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Using_a_Database_to_Decrypt_MD5_hashes\"><\/span>Using a Database to Decrypt MD5 hashes<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>I already introduce the idea behind an MD5 database previously. As any input string will always give the same hash as the result of the MD5 algorithm. We can pre-compile a list of words or strings, and store their MD5 equivalent in a database. <br>We can then use this database against a list of MD5 hashes, and try to use it to decrypt some values.<\/p>\n\n\n\n<p>Here is a short example:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">a:0cc175b9c0f1b6a831c399e269772661<br>b:92eb5ffee6ae2fec3ad71c777531578f<br>c:4a8a08f09d37b73795649038408b5f33<br>d:8277e0910d750195b448797616e091ad<\/pre>\n\n\n\n<p>You can store many words like this. You can create a database sequentially (a&#8230;.z, aa..zz, etc.) or by hashing common words and passwords instead.<br>And the bigger the table is, the more likely you are to find the word for any MD5 hash.<\/p>\n\n\n\n<p>You can use it with a basic search function, depending on the technology you use to create and store the values.<br>On <a href=\"https:\/\/md5online.org\" target=\"_blank\" rel=\"noreferrer noopener\">M5Online.org<\/a>, we have several databases, on several servers, so it&#8217;s not possible to find an MD5 hash with a simple CTRL+F, but you get the idea \ud83d\ude42<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Using_Brute_Force_against_MD5_hashes\"><\/span>Using Brute Force against MD5 hashes<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>The second solution is to use brute force against MD5 hashes. In this case, we don&#8217;t store anything in a database.<br>The MD5 function is fast enough to generate hashes on the fly and compare them with the hash we want to decrypt.<br>By using powerful computers, it can be really fast to find basic words.<\/p>\n\n\n\n<p>You can learn more about the brute force strategy and the tools I recommend <a href=\"https:\/\/infosecscout.com\/how-to-brute-force-a-password\/\" data-type=\"post\" data-id=\"56\" target=\"_blank\" rel=\"noreferrer noopener\">in this article<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Using_Online_Services_to_Crack_MD5_hashes\"><\/span>Using Online Services to Crack MD5 hashes<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>Obviously, the previous techniques are mostly for educational purpose. Building a giant database will require a lot of time and resources, and getting decent results with brute force will also be a huge investment.<\/p>\n\n\n\n<p>A better solution to save time and money is to use services available for free online. Here is how to do this in a few seconds on MD5Online:<\/p>\n\n\n\n<ul><li>Access the <a rel=\"noopener noreferrer\" href=\"https:\/\/www.md5online.org\/md5-decrypt.html\" target=\"_blank\">MD5 decrypt\u00a0page<\/a> by clicking on the link.<\/li><li>You&#8217;ll get a form like this:<br><img loading=\"lazy\" decoding=\"async\" width=\"780\" height=\"188\" class=\"alignnone size-full wp-image-37\" src=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2019\/02\/md5-decryption.jpg\" alt=\"md5 decryption tool\" srcset=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2019\/02\/md5-decryption.jpg 780w, https:\/\/infosecscout.com\/wp-content\/uploads\/2019\/02\/md5-decryption-300x72.jpg 300w, https:\/\/infosecscout.com\/wp-content\/uploads\/2019\/02\/md5-decryption-768x185.jpg 768w\" sizes=\"(max-width: 780px) 100vw, 780px\" \/><\/li><li>Enter your MD5 hash in the field and hit &#8220;Decrypt&#8221;.<br>As an example, you can use this one:\u00a0d49019c7a78cdaac54250ac56d0eda8a.<\/li><li>After a few seconds, you&#8217;ll get a result, like this one for the sample MD5 hash:<br><img loading=\"lazy\" decoding=\"async\" width=\"427\" height=\"69\" class=\"alignnone size-full wp-image-38\" src=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2019\/02\/md5-hash-found.jpg\" alt=\"md5 hash decrypted\" srcset=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2019\/02\/md5-hash-found.jpg 427w, https:\/\/infosecscout.com\/wp-content\/uploads\/2019\/02\/md5-hash-found-300x48.jpg 300w\" sizes=\"(max-width: 427px) 100vw, 427px\" \/><\/li><li>If there is no result, you can give an email address to receive a notification when the MD5 hash will be decrypted.<\/li><\/ul>\n\n\n\n<p>It will not work for any word, but with over 1,154 billion words in the database (and growing), there is a big chance that\u00a0weak passwords will be found. For premium users, we also use other sources and brute force, to get an amazing success rate of 87%.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is a common question with cryptographic algorithms (MD5, SHA1, etc.). The security issues with these algorithms often come from a misunderstanding of what they are and how they work. In this article, we&#8217;ll especially look at the MD5 algorithm and if it can be decrypted or not. As a general rule, the MD5 algorithm&#8230;<\/p>\n","protected":false},"author":1,"featured_media":420,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"categories":[14],"tags":[],"taxonomy_info":{"category":[{"value":14,"label":"Security"}]},"featured_image_src_large":["https:\/\/infosecscout.com\/wp-content\/uploads\/2021\/05\/is-md5-reversible-1024x683.jpg",1024,683,true],"author_info":{"display_name":"Patrick Fromaget","author_link":"https:\/\/infosecscout.com\/about\/"},"comment_info":0,"category_info":[{"term_id":14,"name":"Security","slug":"security","term_group":0,"term_taxonomy_id":14,"taxonomy":"category","description":"Check out our easy-to-follow tips and facts in Security Information. Learn how passwords work and more, all explained in a way that's easy to understand.","parent":0,"count":21,"filter":"raw","cat_ID":14,"category_count":21,"category_description":"Check out our easy-to-follow tips and facts in Security Information. Learn how passwords work and more, all explained in a way that's easy to understand.","cat_name":"Security","category_nicename":"security","category_parent":0}],"tag_info":false,"_links":{"self":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/415"}],"collection":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/comments?post=415"}],"version-history":[{"count":5,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/415\/revisions"}],"predecessor-version":[{"id":421,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/415\/revisions\/421"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/media\/420"}],"wp:attachment":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/media?parent=415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/categories?post=415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/tags?post=415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}