When you download a large file, such as an operating system installer or a game update, you want to know it arrived complete and uncorrupted. Publishers help by listing an MD5 hash: a 32-character code computed from the file’s contents. If your copy of the file produces the same hash, it matches the publisher’s file byte for byte. If it differs, something changed during the download.
What an MD5 hash is
MD5 is a hash function: it takes any input, of any size, and produces a fixed 128-bit fingerprint, shown as 32 hexadecimal characters. Change even one byte of the file and the hash changes completely. That sensitivity is what makes it useful for spotting corrupted downloads. It is not, however, proof against a determined attacker: MD5 is old and cryptographically broken, meaning a skilled attacker can craft a different file with the same MD5 hash. For checking accidental corruption, MD5 is fine. For proving nobody tampered with a file, use SHA-256 instead, which publishers increasingly list alongside MD5.
Method 1: certutil in Command Prompt
Windows includes a built-in tool called certutil, so you need nothing to install. Open Command Prompt, then type certutil -hashfile followed by the file’s path in quotes and the word MD5, for example: certutil -hashfile “C:\Users\you\Downloads\file.iso” MD5. Press Enter. Certutil prints the MD5 hash of the file, then a success message. Put the path in double quotes if it contains spaces, and type the algorithm explicitly: if you leave it out, certutil may use a different algorithm and the result will never match an MD5 value.
Method 2: PowerShell’s Get-FileHash
In PowerShell, type Get-FileHash -Path followed by the file path and -Algorithm MD5. The output shows the algorithm, the hash, and the path. Without the algorithm flag, PowerShell defaults to SHA-256, which is 64 characters and can never equal an MD5 value, so the flag matters. If the file name contains square brackets, use -LiteralPath instead of -Path, because PowerShell otherwise treats brackets as wildcard characters and may fail to find the file.
How to compare the hashes
Copy the hash from the publisher’s download page and compare it character by character with the hash your computer produced. Do not eyeball it: hashes look alike at a glance, and one differing character means a different file. Paste both into a text editor, one above the other, or use a comparison feature if your editor has one. Ignore spaces: certutil’s output may show the hash with spaces between pairs, while the publisher’s version has none. Remove the spaces before comparing. Case does not matter; uppercase and lowercase hex letters represent the same value.
What to do when the hashes do not match
First, re-download the file; most mismatches are interrupted or corrupted downloads, not attacks. Second, check that you compared the right file: a similarly named version, such as a 32-bit build instead of a 64-bit build, has a different hash by design. Third, check that you used the same algorithm; an SHA-256 hash will never match an MD5 hash. If a fresh download from the publisher’s official site still mismatches, do not install the file: contact the publisher or download from a different official mirror. Never bypass a mismatch warning on security software.
Hashing text instead of files
MD5 also works on short text, which is useful for developers and testers who need a quick fingerprint of a string. An online MD5 generator takes your text and returns its hash instantly, without touching your files. Remember that hashing text is encoding-dependent: the same words typed in a different character encoding can produce a different hash, so state the encoding if the hash must be reproducible.
Try it free right here
Use the free MD5 Hash Generator — Generate MD5 Checksums Online Instantly below, right on this page. It runs in your browser and needs no sign-up. You can also open the full tool here: MD5 Hash Generator — Generate MD5 Checksums Online Instantly.