MD5 Decrypt

Paste a hash and this tool tries to recover the original text. It works on MD5, SHA-1, SHA-256 and SHA-512, and it runs entirely in your browser: the search happens on your own machine, and nothing is uploaded. There are two search strategies — Character set, the classic brute-force approach, and Dictionary, which tries real words and leaked passwords first.

Can you actually "decrypt" an MD5 hash?

No — and it's worth being clear about why. A hash is not encryption. Encryption is reversible with a key; hashing is a one-way function designed so the original can't be recovered from the output. There is no "decrypt" operation and no key.

What this tool does instead is guess. It hashes candidate strings one after another and checks whether any of them matches your hash. If the original was short and simple, or a common word or password, a guess will find it quickly. If it wasn't, no tool — this one included — can reverse it.

Character set mode: brute force

Tries every combination over the character sets you tick, shortest first, up to a maximum length (up to 32 characters — the slider doesn't stop you from picking a search too large to finish, it just tells you so). This only ever recovers short inputs over a small set of characters — the number of combinations is the alphabet size raised to the length, so it grows explosively:

• lowercase, up to 4 characters → about 475,000 tries — instant.
• lowercase + digits, up to 5 → about 60 million — a few seconds to a minute.
• add uppercase and symbols, or go past 6 characters → billions or trillions — not feasible in a browser.

The tool shows an estimate of the search size as you change the settings, so you know before you start whether it can finish.

Acceleration (character set mode only, MD5 only): the hashing step can run three ways —

• Standard — plain JavaScript. Always available, and the only mode for lengths beyond 8 characters.
• WebAssembly — the same algorithm compiled to WASM, noticeably faster since it skips JavaScript's general-purpose overhead. Works in any modern browser; the ~2KB kernel is only fetched once you pick this option.
• WebGPU — runs the hash loop on your graphics card, the fastest option by a wide margin where supported. Self-tests itself against a known hash the moment it starts, and falls back to Standard automatically (with an on-screen note) if that check — or anything else about the pipeline — fails on your device.

WebAssembly and WebGPU only accelerate candidates up to 8 characters (a fixed limit of how they pack a candidate for the GPU/WASM kernel); if your max length is set higher, the search finishes lengths 9 and up in Standard JavaScript automatically, with an on-screen note when it switches over. Other algorithms (SHA-1/256/384/512/224) always use the Standard path; WebAssembly/WebGPU are MD5-specific kernels.

Dictionary mode: real words and leaked passwords

Brute force structurally can't reach a 6-10 character password mixing case and digits in reasonable time — that's billions to trillions of combinations. But real people reuse real words and leaked passwords, and those are a comparatively tiny list to check. Dictionary mode tries:

• Common leaked passwords — the 10,000 most common passwords from real-world breaches (on by default).
• Extended English wordlist — 274,000 English words (opt-in — it's a larger download, fetched only once you turn it on).

Both lists are bundled compressed and fetched lazily, client-side — never uploaded, same as everything else here.

On top of the wordlist, three rules (each off by default, since they multiply the search) mimic how real passwords vary from a plain dictionary word:

• Capitalization variants — word, Word, WORD.
• Append digits & years — word1, word2024, word123, and similar common suffixes.
• Leetspeak substitutions — w0rd, p4ssw0rd (a→4, e→3, i→1, o→0, s→5).

How do I use it?

1. Paste the hash. The tool detects the algorithm from the hash length (32 hex characters = MD5, 40 = SHA-1, 64 = SHA-256, 128 = SHA-512) and pre-selects it; adjust if needed.
2. Pick a search strategy — Character set or Dictionary — and its settings.
3. Set a time limit, and raise Web workers to use more of your CPU (character set / dictionary modes only — WebGPU already parallelizes internally).
4. Press Start search. Progress is shown live, and you can stop at any time.

Is this legal / what should I use it for?

Reversing hashes of data you own or are authorised to test — recovering your own forgotten value, checking whether a password you chose is weak enough to be cracked, or CTF and learning exercises. Don't use it against data you have no right to.

Is my hash private?

Yes. Everything runs client-side in a background thread in your browser — including the dictionary and WebAssembly/WebGPU asset fetches, which are same-origin static files, not a lookup service. The hash you paste and any recovered text never leave your device, unlike some online "MD5 decrypters" that send your hash to a server-side lookup database.

What if I need a hash, not a reversal?

To generate a hash, use the MD5 Hash Generator or the SHA Hash Generator.