What is the MD5 file format?
Files with the .md5 extension are small plain-text files used to store checksums. Their purpose is to verify the integrity of downloaded files, disc images, or any other data you want to protect against corruption or tampering.
.md5 files are important for confirming that a file's contents are complete and unaltered. A file can be intentionally modified for malicious purposes or damaged by a storage or transmission error - an .md5 sidecar lets you detect either problem instantly.
Each .md5 file contains a checksum: a fixed-length digest produced by the MD5 algorithm (designed by Ronald Rivest, published as RFC 1321 in 1992). The digest is always 32 lowercase hexadecimal characters, representing a 128-bit (16-byte) value. Even a single changed bit in the source file produces a completely different digest, making any alteration easy to detect. A typical line looks like:
d41d8cd98f00b204e9800998ecf8427e ubuntu.iso
The two spaces separate the hash from the filename; a * prefix on the filename indicates binary mode.
.md5 files were historically used mainly with CD/DVD disc-burning software and disc image creation. Today they appear across a much wider range of contexts - download mirrors, package repositories, and backup tools routinely ship .md5 sidecar files alongside release packages. On Linux the standard tool is md5sum (part of GNU coreutils); on Windows you can use certutil -hashfile or Get-FileHash in PowerShell. Because MD5 is vulnerable to deliberate collision attacks, it is no longer recommended for cryptographic security; .SHA256 and .SHA1 files serve the same purpose with stronger guarantees.
Security & safety
RISK: LOWThe .md5 file is harmless text and cannot run code. The real security point is what MD5 proves: it reliably detects accidental corruption but is cryptographically broken, so a matching MD5 does NOT guarantee a file wasn't maliciously replaced (collisions are feasible). For trust-critical downloads, verify a SHA-256 checksum and the publisher's GPG/PGP signature instead. Also make sure the published hash itself came from a trustworthy source (HTTPS page), not the same place as the file.
Format details
in a nutshellPrograms that open MD5 files
Windows4 apps
ExactFile
Free Use to create and test digest files (.md5) across a folder tree; verifies a download against its .md5. 
Notepad
Built-in Opens the .md5 as text so you can read the expected hash - but it does NOT verify anything; you still compute the file's hash separately.
certutil (built-in)
Built-in Run 'certutil -hashfile yourfile.iso MD5' in Command Prompt, then compare the output to the value in the .md5 file.
PowerShell Get-FileHash
Built-in Run 'Get-FileHash yourfile.iso -Algorithm MD5' and compare the Hash column to the .md5 value. 
macOS2 apps
checkSum+
Free Drag the file in to compute its MD5 and compare against the .md5; GUI alternative to Terminal.
md5 / md5sum (Terminal)
Built-in Run 'md5 yourfile.iso' (or 'md5sum -c file.md5' with coreutils) and compare to the .md5 contents. 
Linux1 app
md5sum (coreutils)
Open-source Run 'md5sum -c file.md5' in the folder with the file - it reports OK or FAILED per entry. Technical details
deep spec| Hash algorithm | MD5 (Message-Digest Algorithm 5), designed by Ronald Rivest, specified in RFC 1321 (1992) |
| Digest length | 128 bits - always encoded as exactly 32 lowercase hexadecimal characters |
| File structure | Plain ASCII text; one entry per line: 32-hex-digest followed by two spaces and the filename (text mode), or a space, asterisk, and filename (binary mode) |
| MIME type | text/plain |
| Character set | ASCII; digest uses only 0-9 and a-f characters; filenames in entries may contain UTF-8 paths |
| Typical file size | 50-100 bytes per entry; a file listing checksums for hundreds of release artifacts typically stays under 20 KB |
| File signature (magic bytes) | None - no binary signature; identified by the .md5 extension and the 32-hex-plus-filename line pattern |
| Multi-file support | A single .md5 file can list checksums for any number of files, one entry per line; md5sum -c verifies all entries in one pass |
| Verification command (Linux/macOS) | md5sum -c checksums.md5 - checks every listed file and reports OK or FAILED per entry |
| Verification command (Windows) | certutil -hashfile <file> MD5 computes the hash; PowerShell: Get-FileHash -Algorithm MD5 | Select-Object Hash |
| Output size invariance | Regardless of source file size - 1 byte or 1 TB - the MD5 digest is always exactly 128 bits / 32 hex characters |
| Case sensitivity | Digest is conventionally lowercase; most tools accept uppercase input but generate lowercase by default |
| Cryptographic status | Collision vulnerabilities publicly demonstrated since 2004; unsuitable for digital signatures or security-critical authentication; acceptable only for detecting accidental corruption |
| Typical use cases | Download integrity verification, ISO disc image checksums, backup validation, Linux distribution releases, software package repositories |
| Successor formats | .sha256 and .sha1 sidecar files provide the identical line-per-file structure but with stronger collision resistance; .sfv files offer a simpler CRC32-based alternative |
| Released | MD5 algorithm 1992 (RFC 1321); .md5 sidecar files in common use since the late 1990s |
| Open standard | Yes · royalty-free |
| Specification | www.rfc-editor.org |
MD5 conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about MD5 files.
