MD5 dates from 1992 and produces a 128-bit digest rendered as 32 hex characters. This page hashes with crypto-js, treating input as UTF-8 — the same convention as every mainstream command-line implementation.
Broken since 2004 — what that actually means
MD5's collision resistance is gone: two different inputs with the same digest can be manufactured in seconds on ordinary hardware. That is not a theoretical footnote — the 2012 Flame malware used an MD5 chosen-prefix collision to forge a Microsoft code-signing certificate. Any use where an attacker profits from producing a matching hash is off the table: digital signatures, certificates, password storage, deduplication of content you did not create yourself.
The nuance is that collision attacks require the attacker to control both inputs. Second-preimage attacks — forging a match against a hash someone else already published — remain impractical, which is why MD5 lingers in low-stakes roles long after its security obituary.
Where it still earns its keep
Detecting accidental corruption after a download, keying a cache, bucketing records across shards, or interoperating with a legacy protocol that hard-codes MD5 — in all of these nobody is trying to forge a match, and MD5's speed is a feature rather than a liability. If you are checking a vendor's published md5sum against a file you just transferred, this is still a legitimate use.
For anything an attacker might target, use the SHA-256 tool instead; for password storage use bcrypt — MD5 is fast and unsalted, which is precisely backwards for that job.