Read and compare MD5 hashes correctly: case, whitespace, hex format

Last reviewed 2026-05-04. A 30-second walk-through for the moment after you generate a hash on MD5 Converter (or read one off a download page) and need to confirm it matches the expected value. Two MD5 hashes either represent the same 16-byte digest or they do not. Case differences, surrounding whitespace, an invisible byte-order mark, or a colon-separator format are cosmetic - the hashes are still the same. A different hex character anywhere, a different total length, or a non-hex character is a real difference - the inputs were not the same.

What an MD5 hash actually is

An MD5 hash is the output of a function that takes any input - a string of text, a file's bytes, a stream from a download - and produces a fixed 16-byte (128-bit) digest. The bytes are the canonical value: that is what "the MD5" really is. The 32-character hexadecimal string you see on screen is just a human-readable encoding of those 16 bytes (each byte becomes two hex characters). Two writers can spell the same 16 bytes as `D41D8CD98F00B204E9800998ECF8427E` (uppercase) or `d41d8cd98f00b204e9800998ecf8427e` (lowercase) or `d4:1d:8c:d9:8f:00:b2:04:e9:80:09:98:ec:f8:42:7e` (colon-separated, common in some legacy tools) and all three are the SAME hash. The bytes are the same.

To generate a fresh MD5 you can compare against a published expected value, paste the original text into MD5 Converter: paste a string and copy the result. If the input was a file rather than a string, see MD5 vs SHA-256 - When to Hash for a tool decision; the comparison rules below are the same in either direction.

Four cosmetic mismatches that still mean a match

Four common screen-level differences look like a mismatch but represent the same 16-byte digest. If you see only these, the hashes match.

• Upper vs lower case. Hex is case-insensitive. `D41D8CD98F00B204E9800998ECF8427E` and `d41d8cd98f00b204e9800998ecf8427e` are the same hash. The lowercase form is the canonical convention used by most modern tools, including the free MD5 Converter; some legacy tools (and many printed release notes) use uppercase. Lowercase both before comparing.
• Leading or trailing whitespace. A stray space, tab, or newline copied along with the hash is invisible on screen but breaks a strict character-by-character compare. Trim both ends before comparing.
• An invisible byte-order mark (BOM). When the expected hash was published in a `.txt` file saved as UTF-8 with a BOM, copying the first line drags an invisible 3-byte sequence (`EF BB BF`) along with the hash. The compare looks like a 35-character string vs a 32-character string. Resave the source file as UTF-8 without BOM, or strip the first 3 bytes from the copied string.
• Colon-separated or space-separated bytes. Some legacy tools format the hash as `d4:1d:8c:d9:8f:00:b2:04:e9:80:09:98:ec:f8:42:7e` (16 byte pairs separated by colons) or `d4 1d 8c d9 8f 00 b2 04 e9 80 09 98 ec f8 42 7e` (space-separated). Strip the separators and the underlying 32-character hex is the same hash.

Three signs the inputs were not the same

If, after the cleanups above, the strings still differ, the inputs were not equal. The two hashes were computed over different bytes.

• Any single hex digit different. MD5 has the avalanche property: a one-bit difference in the input usually flips about half the bits in the output. So even one hex character different anywhere in the 32-character string means the inputs were not the same. There is no "almost the same" for hashes - either every character matches (after the cosmetic cleanups above) or the inputs differed.
• A different total length after the cleanups. An MD5 hex digest is exactly 32 characters. Other lengths mean other algorithms: a 40-character hex string is SHA-1; 64 characters is SHA-256; 8 characters is CRC32 (often shown in decimal, not hex). If your "expected MD5" turns out to be 40 or 64 characters, the publisher used a different algorithm and you need a different tool.
• Non-hex characters. MD5 hex contains only `0-9` and `a-f` (or `A-F`). A `g`, `h`, `z`, or any other letter beyond `f` is not an MD5 hex digit. The most common cause is that the string is base64 (`/=+` and longer letter range) or base32 (`a-z` and `2-7`) - a different encoding of the same 16 bytes, but the comparison rules are then different (still case sensitivity matters in base64).

The 5-step compare flow

Run both hashes through the same five steps and the comparison becomes mechanical.

1. Lowercase both strings. This removes case-insensitive differences in the hex.
2. Trim leading and trailing whitespace. This removes the surrounding-whitespace differences.
3. Strip separators. Remove any `:`, ` ` (space), `-`, or other non-hex character. The result should be a single 32-character string of hex digits.
4. Confirm the length is 32 and the characters are all in `0-9 a-f`. If either side fails this check, you are comparing something that is not an MD5 hex digest (or there is still BOM / invisible-character contamination; paste the string into a hex inspector to spot it).
5. Compare character-by-character. If steps 1-4 produced two identical 32-character hex strings, the hashes match - the underlying 16 bytes are the same and the inputs were the same. If they differ at any position, the inputs were different.

When MD5 is enough - and when it is not

MD5 is appropriate for accidental-corruption checks where no adversary is involved: confirming a download finished without bit-rot when the publisher posted the expected MD5 alongside the file; verifying a colleague's file transfer against the MD5 they sent in the same email. The probability of two unrelated files producing the same MD5 by accident is vanishingly small. So if you generated a hash on MD5 Converter and it matches the published value after the 5-step flow, the file is the file the publisher meant.

MD5 is NOT appropriate for adversarial use cases - password storage, security signatures, forgery resistance. Researchers can now generate two different files with the same MD5 in seconds on commodity hardware. For those cases the right tool is a different algorithm. See MD5 vs SHA-256 - When to Hash for the algorithm-choice question, MD5 Alternatives - bcrypt vs Argon2id vs SHA-256 for the modern password-storage answer, and Why MD5 Cannot Be Decrypted for the related "I have an MD5 and want the original text" question.

Companion guides on the developer/MD5 cluster: MD5 vs SHA-256 - When to Hash (algorithm choice), Why MD5 Cannot Be Decrypted (why MD5 is not reversible), MD5 to Text - Why You Cannot Convert It Back (operational counterpart), and MD5 Alternatives - bcrypt vs Argon2id vs SHA-256 (modern alternatives for adversarial use).