# If hashing is one way, why can we decrypt MD5 hashes?

I have read some times that hashing is a one way function, that is you can make the hash of a message, but you can't recover the original message from the hash, just check its integrity.

However, if this were true, why can we decrypt MD5 hashes and get the original data?

• Since you posit MD5 is "decryptable", please recover the original data for this hash: `0cca9b3eeae7b8747eaf61f8d282156d`. I'll even give you a hint, it's a real md5 of 42 character ASCII string. PS, using the best public attacks on MD5 this should only take work 2**123 ~ 10,633,823,966,279,326,983,230,456,482,242,756,608 or at a billion hashes per second on a billion computers, it should only take about 170 billion years on average. Commented Jun 28, 2013 at 18:22
• @drjimbob: Assuming 42 printable ASCII characters, there are probably about 3.4e+44 such strings with that same MD5 hash. (9542 strings divided by 2128 possible MD5 hashes.) So your 170 billion years of work will give you a few hundred tredecillion possible answers, and no way to know which one is correct. If I were you, I'd almost consider not bothering. Commented Jun 29, 2013 at 1:00
• @drjimbob I'm sure I can find a collision before that with rainbow tables. Used to be a time when Google had indexed at least one collision of most md5 hashes until the modified their search input to ignore hex strings of certain lengths. Commented Jun 29, 2013 at 5:48
• @ewanm89 - Want to bet? I'm willing to bet a \$200 donation to any legitimate charity of loser's choice (say Cancer Research Institute - cancerresearch.org) if you can prove me wrong in the next month (I'd agree for longer terms if you need it, but risk forgetting about the wager). Full disclosure, I only vaguely remember the original string. So if you can generate an input (not necessarily my string) md5sums to that hash or this one `0113fd21d9ec4e367abb761b26ef6010` (also 42 ascii chars but I saved this string to disk). Or if you want we could do a straight-up bet via bitcoin. Commented Jun 29, 2013 at 6:51
• @ewanm89 - I take you couldn't find a collision with your MD5 rainbow tables. A rainbow table is just a time-memory tradeoff, every hash still has to be computed (plus apply a reduction function). Imagine a powerful adversary built a rainbow table with 280 MD5s. (If one MD5 takes 1 cpu-nanosecond this would require 38 billion CPU years, 10 billion computers for ~4 years, to construct). With this and a 128-bit MD5 of a high-entropy passphrase, the chance of one of my MD5s being broken is ~1 in 248 (281,474,976,710,656). Granted a stronger unpublished preimage attack on MD5 could exist. Commented Jul 1, 2013 at 16:04

• @Walkerneo - Tom said "hash twice the same value" not "hash twice a value". It is not ambiguous by any stretch of imagination, unless you can find a hash of a certain input that is exactly the same to its input. Needless to say, if you have `h(v) = v` your `h` doesn't do its job correctly as a hash function. Commented Jun 29, 2013 at 13:21