{"id":467,"date":"2021-06-29T09:32:03","date_gmt":"2021-06-29T07:32:03","guid":{"rendered":"https:\/\/infosecscout.com\/?p=467"},"modified":"2023-11-22T13:00:14","modified_gmt":"2023-11-22T12:00:14","slug":"where-is-md5-used","status":"publish","type":"post","link":"https:\/\/infosecscout.com\/where-is-md5-used\/","title":{"rendered":"Where is MD5 used? (Most common applications explained)"},"content":{"rendered":"\n<p>MD5 is a cryptographic hash function, that has many advantages like the speed to generate them and the almost irreversible algorithm. These have leaded the MD5 algorithm to be widely used in the past, but where is this function still used nowadays?<\/p>\n\n\n\n<p><strong>The most common application of the MD5 algorithm is now to check files integrity after a transfer. By generating a MD5 file before and after a file transfer, it&#8217;s possible to identify any corruption. MD5 is also still used to store passwords in some databases, even if it&#8217;s no longer safe.<\/strong><\/p>\n\n\n\n<p>In this article, I&#8217;ll introduce both applications and give you some links to learn more about each of them.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_65 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title \" >Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/infosecscout.com\/where-is-md5-used\/#Reminder_about_the_MD5_algorithm\" title=\"Reminder about the MD5 algorithm\">Reminder about the MD5 algorithm<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/infosecscout.com\/where-is-md5-used\/#Using_MD5_as_an_integrity_checker\" title=\"Using MD5 as an integrity checker\">Using MD5 as an integrity checker<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/infosecscout.com\/where-is-md5-used\/#Using_MD5_to_store_passwords_in_a_database\" title=\"Using MD5 to store passwords in a database\">Using MD5 to store passwords in a database<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Reminder_about_the_MD5_algorithm\"><\/span>Reminder about the MD5 algorithm<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p><strong>MD5 stands for \u201cMessage Digest algorithm 5\u201d.<br><\/strong>It\u2019s a hash function that will convert any input (number, string or file from any length) to an output containing 32 hexadecimal characters.<\/p>\n\n\n\n<p>For example, the MD5 hash corresponding to the string \u201cMD5Online\u201d is \u201cd49019c7a78cdaac54250ac56d0eda8a\u201d.<br>There is no logic in the result, and if you have only the MD5 hash, good luck to find the original value.<\/p>\n\n\n\n<p>The main strengths of this algorithm compared to other solution is the native support on any operating system and the speed to generate a MD5 hash. It won&#8217;t slow any process, so it&#8217;s perfect to use it even with large dataset.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Using_MD5_as_an_integrity_checker\"><\/span>Using MD5 as an integrity checker<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p><strong>The MD5 algorithm is now mostly used to check files integrity after a transfer. With large files especially, you&#8217;ll often find a MD5 file on the download page, allowing you to check if the download is complete and valid.<\/strong><\/p>\n\n\n\n<p>In general, a MD5 file contains only one MD5 hash. This hash is the fingerprint of a bigger file, generated with the md5sum program. As you might know, the MD5 algorithm is not perfect, but it always gives the same result for a specific input. If the input doesn\u2019t change, the output will always be the same hash.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"728\" height=\"506\" src=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2020\/07\/hashmyfiles.jpg\" alt=\"\" class=\"wp-image-135\" srcset=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2020\/07\/hashmyfiles.jpg 728w, https:\/\/infosecscout.com\/wp-content\/uploads\/2020\/07\/hashmyfiles-300x209.jpg 300w\" sizes=\"(max-width: 728px) 100vw, 728px\" \/><\/figure><\/div>\n\n\n\n<p>There are many tools that can be used to <a rel=\"noreferrer noopener\" href=\"https:\/\/infosecscout.com\/generate-md5-file-checksum\/\" data-type=\"post\" data-id=\"128\" target=\"_blank\">generate a MD5 file<\/a> (link to my article on the topic). Whatever the operating system you use, you should be able to quickly find a solution, either a native way to do it (often in command line) or by installing a graphical tool to do the same thing without any required skill.<\/p>\n\n\n\n<p>The person hosting the file (let&#8217;s say a big ISO file) will share the file and the corresponding MD5 file. After downloading the ISO file, you can generate a MD5 file on your computer and compare the result with the one provided by the host.<\/p>\n\n\n\n<p><a href=\"https:\/\/infosecscout.com\/how-to-open-an-md5-file\/\" target=\"_blank\" rel=\"noreferrer noopener\">I recommend reading this other article<\/a> if the process is not clear enough for you.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Using_MD5_to_store_passwords_in_a_database\"><\/span>Using MD5 to store passwords in a database<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p><strong>The MD5 algorithm has been popular in the past to crypt passwords in databases. The goal was to avoid keeping them in clear text. This way they were not exposed in case of security breach or hack. Since then, using the MD5 algorithm for this is no longer recommended.<\/strong><\/p>\n\n\n\n<p>Even if the <a rel=\"noreferrer noopener\" href=\"https:\/\/infosecscout.com\/is-md5-reversible\/\" data-type=\"post\" data-id=\"415\" target=\"_blank\">MD5 function is not reversible<\/a> in the literal sense of the word, it&#8217;s becoming easier each year to break them and find the original value. With technology improvements over the years, it&#8217;s now really fast to crack any short password (<a rel=\"noreferrer noopener\" href=\"https:\/\/infosecscout.com\/is-md5-easy-to-crack\/\" data-type=\"post\" data-id=\"449\" target=\"_blank\">time to crack a password are listed here<\/a>).<\/p>\n\n\n\n<p><a href=\"https:\/\/infosecscout.com\/how-to-brute-force-a-password\/\" data-type=\"post\" data-id=\"56\" target=\"_blank\" rel=\"noreferrer noopener\">Brute force<\/a>, dictionaries and rainbow table are strategies that work well against MD5 hashes. Current computers can use powerful GPU resources to get a high success rate on any MD5 hash generated by a short password or common word. That&#8217;s why this second usage is less and less frequent, even if it&#8217;s still used in some code because it&#8217;s not that easy to switch to another algorithm.<\/p>\n\n\n\n<p>If you want an example on how bad this idea is, you can check our main website <a rel=\"noreferrer noopener\" href=\"https:\/\/md5online.org\" target=\"_blank\">MD5Online<\/a> and see by yourself how fast we can decrypt most MD5 hashes. We have almost a 90% success rate for our premium customers. And our infrastructure is not that big, there is no doubt that larger hacker organizations are much better equipped.<\/p>\n\n\n\n<p>By the way, if you are interested in how MD5 decryption really works, I highly encourage you to <a rel=\"noreferrer noopener\" href=\"https:\/\/www.md5online.org\/ebook.html\" target=\"_blank\">take a look at my e-book &#8220;The Secrets of MD5 Decryption&#8221;<\/a><a href=\"https:\/\/www.md5online.org\/ebook.html\" target=\"_blank\" rel=\"noreferrer noopener\"> <\/a><a rel=\"noreferrer noopener\" href=\"https:\/\/www.md5online.org\/ebook.html\" target=\"_blank\">here<\/a>. It explains everything you need to know, going directly to the point with practical examples you can test on your computer. You don&#8217;t need any hardware to get started, just a few tips I give in this book. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>MD5 is a cryptographic hash function, that has many advantages like the speed to generate them and the almost irreversible algorithm. These have leaded the MD5 algorithm to be widely used in the past, but where is this function still used nowadays? The most common application of the MD5 algorithm is now to check files&#8230;<\/p>\n","protected":false},"author":1,"featured_media":470,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"categories":[14],"tags":[],"taxonomy_info":{"category":[{"value":14,"label":"Security"}]},"featured_image_src_large":["https:\/\/infosecscout.com\/wp-content\/uploads\/2021\/06\/where-md5-is-used-1024x683.jpg",1024,683,true],"author_info":{"display_name":"Patrick Fromaget","author_link":"https:\/\/infosecscout.com\/about\/"},"comment_info":0,"category_info":[{"term_id":14,"name":"Security","slug":"security","term_group":0,"term_taxonomy_id":14,"taxonomy":"category","description":"Check out our easy-to-follow tips and facts in Security Information. Learn how passwords work and more, all explained in a way that's easy to understand.","parent":0,"count":21,"filter":"raw","cat_ID":14,"category_count":21,"category_description":"Check out our easy-to-follow tips and facts in Security Information. Learn how passwords work and more, all explained in a way that's easy to understand.","cat_name":"Security","category_nicename":"security","category_parent":0}],"tag_info":false,"_links":{"self":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/467"}],"collection":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/comments?post=467"}],"version-history":[{"count":3,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/467\/revisions"}],"predecessor-version":[{"id":471,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/467\/revisions\/471"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/media\/470"}],"wp:attachment":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/media?parent=467"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/categories?post=467"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/tags?post=467"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}