pqcstatus
Algorithm

MD5: quantum risk, deadlines and replacements

Weakened by quantum

Broken hash function (practical collisions). Must not be used for any security purpose.

At a glance

Quantum riskWeakened by quantum
Used forHash function
Post-quantum algorithmNo

Positions and deadlines by authority

AuthorityPositionEffectiveScopeDetails
IETFDisallowedin forceall variantsNot acceptable for signatures or any collision-resistance use.

Recommended replacements

Sources

  1. RFC 6151 — Updated Security Considerations for the MD5 Message-Digest and HMAC-MD5 Algorithms · IETF

Catalog version 2026-09-28. Every position links to its primary source; draft documents are labelled as such.

Frequently Asked Questions

Is MD5 quantum-safe?

Partially. Grover’s algorithm reduces its effective security; larger variants remain adequate, while broken legacy variants must be retired now.

What should replace MD5?

SHA-2, SHA-3.