Reverse MD5, SHA-1, SHA-256/512 & MySQL hashes — matched against 1,000,000+ real passwords.

  • Free & unlimited
  • No signup
  • Hashes never stored
MD5Decrypt
Decrypt a hash

Decrypt a hash in milliseconds

Paste an MD5, SHA-1, SHA-256, SHA-512 or MySQL hash and get the original text back — matched in real time against a database of over a million real-world passwords.

  • 1,000,000+passwords indexed
  • 8hash algorithms
  • FreeJSON API
Hash decrypter

One hash per line — MD5, SHA or MySQL. We detect the type for you.

Not stored, not logged Instant lookup 8 algorithms

Supported hash types

8 algorithms, recognised automatically from the hash you paste.

  • MD5 128-bit

    The classic. Still everywhere.

    32 hex characters

  • MD5(MD5) Double

    md5(md5($pass)) — a common “salt-free” scheme.

    32 hex characters

  • SHA-1 160-bit

    Legacy, but far from gone.

    40 hex characters

  • SHA-224 SHA-2

    Truncated SHA-256.

    56 hex characters

  • SHA-256 SHA-2

    The modern default.

    64 hex characters

  • SHA-384 SHA-2

    Truncated SHA-512.

    96 hex characters

  • SHA-512 SHA-2

    64-bit words, 512-bit digest.

    128 hex characters

  • MySQL41 PASSWORD

    MySQL’s PASSWORD() — a “*” then 40 hex.

    “*” + 40 hex

How it works

Three steps, none of which involve breaking any cryptography.

  1. 1

    Paste your hash

    One or many, one per line. We read the length and shape to work out which algorithm produced each.

  2. 2

    We look it up

    Every hash is matched against a pre-computed index of a million common passwords — a single seek, not a brute-force search.

  3. 3

    Get the plaintext

    If the original text is one we know, it comes straight back, ready to copy. If not, you get an honest “not found”.

A hash is one-way, so this is a dictionary lookup rather than true decryption: we can only return text that is already in our database. Why that matters ›

Developers

Automate it with the API

Every lookup the site makes is a call you can make yourself. One endpoint, JSON in and out, no API key.

  • POST a batch, or GET a single hash
  • Type detected for you
  • The same “never stored” promise
Terminal 
curl -s https://md5decrypt.io/api/decrypt \
     -d hash=5f4dcc3b5aa765d61d8327deb882cf99

{
  "hash":  "5f4dcc3b5aa765d61d8327deb882cf99",
  "type":  "md5",
  "found": true,
  "plain": "password"
}

Questions & answers

What this tool is, and — just as important — what it isn’t.

What is MD5Decrypt?

MD5Decrypt is a free online tool that reverses cryptographic hashes. You give it a hash — an MD5, SHA-1, SHA-256, SHA-512 or MySQL fingerprint — and it returns the original text, whenever that text is one it already knows.

Is this actually “decryption”?

Not in the strict sense. Hashes are one-way: you cannot compute the input from the output. What this tool does is a dictionary lookup — it has already hashed millions of known passwords, so it can recognise a hash it has seen before and hand back the matching text. A truly random or never-seen input will not be found.

Which hash types are supported?

MD5, double MD5 (md5(md5())), SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 and MySQL41 — the MySQL PASSWORD() function. The type is detected automatically from the hash you paste.

Why wasn’t my hash found?

Either the original text isn’t in our dictionary of common passwords, or the hash is salted, or it is simply a random string. A “not found” result means we don’t have that plaintext — not that the hash is invalid.

Do you store the hashes I submit?

No. Lookups are answered in memory and the hashes are never written to our logs or our database. The API endpoint even runs with request logging switched off for exactly this reason.

Is it free?

Yes — the website and the JSON API are both free to use, with no signup and no API key.