How to Get the MD5 Hash of a File
How do I get the MD5 hash of a file?
Use the built-in command for your platform: certutil -hashfile path MD5 or Get-FileHash path -Algorithm MD5 on Windows, md5 /path on macOS, md5sum /path on Linux. The tool prints 32 hex characters. Compare that string character for character with the published hash, or verify a .md5 sidecar file automatically.
What you need
The file you downloaded and the official hash published beside the download link. Publishers often list 32 hex characters next to the file, or ship a .md5 file, which is a plain text file containing that hash and sometimes the filename. Keep that reference value before you compute.
Windows: PowerShell Get-FileHash
Open PowerShell and run Get-FileHash "C:\Downloads\setup.exe" -Algorithm MD5. The Hash property is the 32-character result. It works on Windows 10 and 11 without installing anything, reads large files in streaming fashion, and is case insensitive when you compare.
Windows: certutil
On any Windows since 7, run certutil -hashfile "C:\Downloads\setup.exe" MD5 in Command Prompt. The checksum appears on its own line after a short processing pause. This is the widest compatible option for enterprise and legacy scripts.
macOS: md5
Run md5 /path/to/file.zip in Terminal. The output is MD5 (/path/to/file.zip) = followed by 32 hex characters. Append -q for the hash alone, useful in scripts. The command reads the entire file, so large files take a few seconds.
Linux: md5sum
Run md5sum /path/to/file.zip. The output is the hash, two spaces, then the filename. Verify against a sidecar file with md5sum -c file.md5, which reads each line of the .md5 file and prints OK or FAILED per entry. Most distributions include this in coreutils.
Online and programmatic
For text or small files you can compute MD5 in the browser with the MD5 Hash Generator, which runs locally. In code use hashlib.md5 in Python, crypto.createHash("md5") in Node.js, or MessageDigest MD5 in Java. These produce the same 32 characters for the same bytes.
Compare and diagnose mismatches
Paste both hashes into a plain text comparison and check character for character, ignoring case. A mismatch means the file was corrupted, re-downloaded with changes, or you hashed the wrong file. Delete, re-download from a trusted mirror, and verify again. If the same file keeps failing, treat the source or channel as untrusted. For integrity that must resist tampering, use SHA-256 instead of MD5.
MD5 is not for tampering: collision demo
MD5 is fine for catching accidental corruption, but it is broken for tampering. Since Wang et al. 2004, attackers can craft two different files with the same MD5. The classic pair starts d131dd02c5e6... and d131dd02c5e6... (128 bytes each, same MD5 d41d8cd98f00b204e9800998ecf8427e). Run md5sum good.bin bad.bin to see the same hash, then sha256sum good.bin bad.bin to see different hashes. That is why new integrity designs use SHA-256, and passwords use bcrypt.
Try it in your browser with our MD5 Hash Generator. No upload, no server.
Open MD5 Hash Generator →FAQ
What command gets an MD5 on Windows?
Get-FileHash "path\to\file" -Algorithm MD5 in PowerShell, or certutil -hashfile "path\to\file" MD5 in Command Prompt.
How do I verify a .md5 file on Linux?
Run md5sum -c archive.md5 in the same directory. The tool reads each hash and filename from the .md5 file and reports OK or FAILED for each entry.
Are MD5 hashes case sensitive?
No. Hex digits match case insensitively, so 5d41402abc and 5D41402ABC are identical.
Can I get an MD5 without installing anything?
Yes. certutil and Get-FileHash ship with Windows, md5 ships with macOS, and md5sum ships with Linux coreutils. All three read the whole file locally.
Why do my hashes not match?
The file changed since the reference was published, the download was corrupted, or you hashed a different file. Re-download and compare again character for character.