Any file type, up to 2 MB
Not strictly. Encryption is reversible — with the key you can recover the original. MD5 is a one-way hash function that compresses input of any length into a fixed 128-bit digest. Information is discarded along the way, so there is no “undo” step to perform. People routinely say “MD5 encryption”, and this page follows that habit — what it means in practice is computing an MD5 value.
No. Every site that claims to “decrypt MD5” is really doing a rainbow-table lookup: it precomputes the MD5 of vast lists of common secrets (123456, admin, dictionary words, phone-number prefixes and so on) and stores them. You paste in a hash and it checks whether that hash is in the table. A hit means your input happened to be a common string; a miss means there is nothing more it can do.
The practical consequence is twofold. A long random passphrase, or any password salted before hashing, will not be found by such a site. Conversely, if one of them resolves your password instantly, that password was already in a public wordlist and you should change it now.
It remains a reasonable choice for integrity checks: compute the MD5 of a file you downloaded and compare it with the value the publisher published, to confirm the transfer was not corrupted. It is also common for cache keys, deduplication IDs and other non-security purposes.
It should not be used for anything security-related. Practical collision attacks have existed for years — producing two different files with the same MD5 takes an ordinary computer seconds — so MD5 cannot detect tampering or back a digital signature. To store user passwords, use a purpose-built slow hash such as bcrypt, scrypt or Argon2, which salt automatically and let you tune the work factor.
The 32-character form is the complete MD5 value — all 128 bits written in hexadecimal — and it is what you want whenever the result has to match someone else's. The 16-character form is a conventional middle slice of those same 32 characters: a substring, not a different algorithm. Fewer characters means a higher chance of collision, so it only suits display contexts with a length limit.
MD5 produces a 128-bit (16-byte) hash, SHA-1 produces 160 bits and SHA-256 produces 256 bits. More bits means, in theory, stronger collision resistance. Both MD5 and SHA-1 have been broken and are unsuitable for security use; SHA-256 remains the mainstream secure hash today.
No. MD5 is a one-way hash function and is irreversible by design. Sites advertising “MD5 decryption” perform rainbow-table lookups, which only succeed for strings already in their table — a long random passphrase or a salted password will not be found. See “About MD5 encryption and decryption” above for the full explanation.
Large files consume a lot of memory in the browser, and MD5 is typically used to check the integrity of small files or strings. For large files, prefer a chunked computation with SHA-256 or another modern algorithm.
The 32-character form is the complete MD5 hash (128 bits written in hexadecimal). The 16-character form is simply its middle 16 characters (positions 9 through 24). It is not a separate algorithm — just a substring of the 32-character value.