Skip to content


The Message-Digest algorithm 5 (MD5) is a cryptographic hash function that produces a 128-bit hash value. Originally developed in 1991, much as has been written about this algorithm. As such, this article concentrates only on its application to computer forensics.


On most Unix systems the tools digest, md5 (BSD) or md5sum can be used to compute the MD5 hash of a file or device. md5deep can compute MD5 hashes of whole directory trees.


Recently some cryptographic weaknesses have been found in MD5. Tool developers should avoid using MD5 in new products in favor of other hash functions like RIPEMD-160, Tiger, WHIRLPOOL, SHA-256 or SHA-512. Host Intrusion Detection systems and hash databases should also use multiple hash algorithms.