{"id":48,"date":"2019-02-10T08:12:27","date_gmt":"2019-02-10T07:12:27","guid":{"rendered":"https:\/\/infosecscout.com\/?p=48"},"modified":"2023-11-22T13:02:41","modified_gmt":"2023-11-22T12:02:41","slug":"decrypt-md5-php","status":"publish","type":"post","link":"https:\/\/infosecscout.com\/decrypt-md5-php\/","title":{"rendered":"How to Decrypt MD5 Passwords in PHP?"},"content":{"rendered":"\n<p>If you are new in the MD5 world, you probably ask yourself how to decrypt MD5 passwords in PHP after encrypting them.<br>In this post, I&#8217;ll show you how to do this, but you probably need an explanation about the MD5 algorithm before&nbsp;\ud83d\ude42<\/p>\n\n\n\n<p><strong>The MD5 cryptographic algorithm is not reversible<\/strong>.<br><strong>PHP can encrypt any word into MD5, but not decrypt an MD5 hash to retrieve the original word<\/strong>.<br><strong>When using the MD5 algorithm to check passwords in PHP, we must have both side encrypted (the password typed and the password stored in the database).<\/strong><\/p>\n\n\n\n<p>I&#8217;ll remind you what is the MD5 algorithm and why you can&#8217;t reverse it to find the password.<br>Then I&#8217;ll show you how to validate the password in your code (with PHP samples).<br>And finally, I&#8217;ll show you how to use the MD5Online API to find lost passwords.<\/p>\n\n\n\n<p>By the way, if you are interested in how MD5 decryption really works, I highly encourage you to <a rel=\"noreferrer noopener\" href=\"https:\/\/www.md5online.org\/ebook.html\" target=\"_blank\">take a look at my e-book &#8220;The Secrets of MD5 Decryption&#8221;<\/a><a href=\"https:\/\/www.md5online.org\/ebook.html\" target=\"_blank\" rel=\"noreferrer noopener\"> <\/a><a rel=\"noreferrer noopener\" href=\"https:\/\/www.md5online.org\/ebook.html\" target=\"_blank\">here<\/a>. It explains everything you need to know, going directly to the point with practical examples you can test on your computer. You don&#8217;t need any hardware to get started, just a few tips I give in this book. <\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/infosecscout.com\/decrypt-md5-php\/#What_is_MD5\" >What is MD5?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/infosecscout.com\/decrypt-md5-php\/#MD5_encryption\" >MD5 encryption<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/infosecscout.com\/decrypt-md5-php\/#MD5_decryption\" >MD5 decryption<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/infosecscout.com\/decrypt-md5-php\/#How_to_validate_MD5_passwords\" >How to validate&nbsp; MD5 passwords?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/infosecscout.com\/decrypt-md5-php\/#Theory\" >Theory<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/infosecscout.com\/decrypt-md5-php\/#PHPMySQL_samples\" >PHP\/MySQL samples<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/infosecscout.com\/decrypt-md5-php\/#Create_a_user_account\" >Create a user account<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/infosecscout.com\/decrypt-md5-php\/#Validate_the_user_password\" >Validate the user password<\/a><\/li><\/ul><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/infosecscout.com\/decrypt-md5-php\/#How_to_finally_decrypt_passwords_in_PHP_API\" >How to finally&nbsp;decrypt passwords in PHP? (API)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/infosecscout.com\/decrypt-md5-php\/#Conclusion\" >Conclusion<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_is_MD5\"><\/span>What is MD5?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"MD5_encryption\"><\/span>MD5 encryption<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p><strong>MD5 is an algorithm that generates a 32 characters string (hexadecimal) for any word or phrase given in input.<\/strong><br>You can even encrypt an entire file into a MD5 hash.<\/p>\n\n\n\n<p>Here is an example:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">MD5(\"MD5Online\") = d49019c7a78cdaac54250ac56d0eda8a<\/pre>\n\n\n\n<p>If you are interested in the encryption algorithm, you can check the Wikipedia page.<br>But for the moment you just&nbsp;have to remember that there is an infinite possibility of input for a finite output&nbsp; possibilities (always 32 characters).<\/p>\n\n\n\n<p>So, the MD5 output is not unique, and you can&#8217;t reverse it.<br>But we&#8217;ll see in the next paragraph how the decryption works.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"MD5_decryption\"><\/span>MD5 decryption<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>You must be saying, &#8220;If decryption is impossible, how does MD5Online work?&#8221;.<\/p>\n\n\n\n<p>In fact, the good answer is:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>There is no decryption algorithm, the function md5_decrypt() doesn&#8217;t exist<\/strong><\/li><li><strong>But every encryption process gives the same result<\/strong><\/li><\/ul>\n\n\n\n<p>So, I now know that&nbsp;the MD5 hash corresponding to &#8220;MD5Online&#8221; is&nbsp;d49019c7a78cdaac54250ac56d0eda8a (previous part).<br>If someone asks me to decrypt this hash, I&#8217;m able to answer that there is a good chance that&nbsp;&#8220;MD5Online&#8221; is the encrypted word.<\/p>\n\n\n\n<p>That is how the <a rel=\"noopener noreferrer\" href=\"https:\/\/www.md5online.org\/md5-decrypt.html\" target=\"_blank\">MD5 decryption tool<\/a> is working on MD5Online.<br>We have a giant database of known MD5 hash, so we can find the result for a lot of hash.<\/p>\n\n\n\n<p>The answer to your question is: no, it&#8217;s not really&nbsp;possible to decrypt MD5 passwords in PHP.<br>So, how can you validate user passwords if you can&#8217;t decrypt the database field?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_to_validate_MD5_passwords\"><\/span>How to validate&nbsp; MD5 passwords?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Theory\"><\/span>Theory<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p><strong>The MD5 algorithm is very&nbsp;fast.<br>So, you can use it where you want, without slowing down your website.<\/strong><\/p>\n\n\n\n<p>That&#8217;s why we were using MD5 to store passwords in a database.<br>And so to validate them, you can encrypt the input password, and check it with the database one.<\/p>\n\n\n\n<p>The pseudo-code will look like this:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">IF (MD5(INPUT_STRING) == DATABASE_PASSWORD)\nTHEN LOGIN()<\/pre>\n\n\n\n<p>I&#8217;ll show you in the next paragraph how to manage the two steps with PHP.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"PHPMySQL_samples\"><\/span>PHP\/MySQL samples<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Create_a_user_account\"><\/span>Create a user account<span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<p>The first step is to create a user account.<br>To do this, you need to create a database, with at least two fields: username and password.<\/p>\n\n\n\n<p>For example, in MySQL, you can create something like this:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">CREATE TABLE IF NOT EXISTS `users` (\n  `username` varchar(32) NOT NULL,\n  `password` varchar(32) NOT NULL,\n  PRIMARY KEY (`username`)\n)<span id=\"selectionBoundary_1549780565656_4024080884425718\" class=\"rangySelectionBoundary\" style=\"line-height: 0; display: none;\"><\/span><\/pre>\n\n\n\n<p><span id=\"selectionBoundary_1549780567340_9816191995990133\" class=\"rangySelectionBoundary\" style=\"line-height: 0; display: none;\"><\/span><strong>The password will be MD5 encrypted, so it will always be 32 characters length.<\/strong><\/p>\n\n\n\n<p>To create a new user with PHP, you have to&nbsp;do something like that:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">mysqli_query(\"INSERT INTO users (username, password) \nVALUES ('\".$_POST['username'].\"','\".md5($_POST['password']).\"'\"));<\/pre>\n\n\n\n<p>You probably already done that, you just&nbsp;need to use the md5() function to encrypt the password.<br><strong>I recommend <a rel=\"noopener noreferrer\" href=\"https:\/\/infosecscout.com\/md5-salt-hash\/\" target=\"_blank\">using salt with MD5<\/a><\/strong>, but it&#8217;s not mandatory to understand the process.<\/p>\n\n\n\n<p>Obviously, before that, you need to connect to your MySQL database server, probably clean the $_POST data, and create a form in HTML to register the user.<br>But we are not here for a basic PHP lesson \ud83d\ude42<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Validate_the_user_password\"><\/span>Validate the user password<span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<p>Then come the part you didn&#8217;t know before reading this article.<br><strong>In the login process, you need to compare the input password to the database password.<\/strong><\/p>\n\n\n\n<p>Here is what you can do:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$query = mysqli_query(\"SELECT * FROM users \nWHERE username='\".$_POST['username'].\"' \nAND password='\".md5($_POST['password']).\"');\n\nif(mysqli_num_rows($query)) {\n   \/\/connect\n}\nelse {\n   \/\/bad password\n}<\/pre>\n\n\n\n<p><strong>So again, we&#8217;ll use the md5() function to encrypt the password before logging in the user.<br>We only check that the input password is the same as in the database.<\/strong><\/p>\n\n\n\n<p>At no time it is necessary to decrypt the password stored in the database.<span id=\"selectionBoundary_1549781159851_4014678733035859\" class=\"rangySelectionBoundary\" style=\"line-height: 0; display: none;\"><\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_to_finally_decrypt_passwords_in_PHP_API\"><\/span>How to finally&nbsp;decrypt passwords in PHP? (API)<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>If you still need to decrypt a high number of MD5 passwords for another reason that the one we have just seen, I have a solution for you.<\/p>\n\n\n\n<p><strong>MD5Online offer an API you can use in PHP (or with other languages) to send requests directly in our database<br>That way you can decrypt a lot of MD5 encrypted passwords automatically in PHP.<\/strong><\/p>\n\n\n\n<p>This is a paid service, if you are interested you will find more info <a href=\"https:\/\/www.md5online.org\/decrypt-modes.html\" target=\"_blank\" rel=\"noreferrer noopener\">on this page<\/a>.<\/p>\n\n\n\n<p>As soon as you have your VIP key, you can use this sample code:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><span class=\"hljs-meta\">&lt;?php<\/span>\n$url = <span class=\"hljs-string\">'https:\/\/www.md5online.org\/api.php'<\/span>;\n$key = <span class=\"hljs-string\">'YOUR_VIP_KEY'<\/span>;\n\n<span class=\"hljs-comment\">\/\/manage your input here, from a form, a file or a database<\/span>\n$md5 = <span class=\"hljs-string\">\"d3c8e06e57cc1af7ebdba01427e62bc2\"<\/span>;\n\n$result = file_get_contents($url.<span class=\"hljs-string\">\"?p=\"<\/span>.$key.<span class=\"hljs-string\">\"&amp;h=\"<\/span>.$md5);\n\n<span class=\"hljs-comment\">\/\/do your post action here, with the result<\/span>\n<span class=\"hljs-keyword\">echo<\/span> $result;\n<span class=\"hljs-meta\">?&gt;<\/span><\/pre>\n\n\n\n<p>I&#8217;ll let you adding a loop, and maybe a query to get all the passwords at once from your database.<br>But you have here the minimal part to use the MD5Online API in PHP.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Conclusion\"><\/span>Conclusion<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>That&#8217;s it, you now know how to decrypt MD5 passwords in PHP.<br>Or rather how to use them without decrypting them.<\/p>\n\n\n\n<p>But I also give you a way to really decrypt them with the MD5Online API.<br>I hope you enjoy this article, feel free to&nbsp;share if it was helpful \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you are new in the MD5 world, you probably ask yourself how to decrypt MD5 passwords in PHP after encrypting them.In this post, I&#8217;ll show you how to do this, but you probably need an explanation about the MD5 algorithm before&nbsp;\ud83d\ude42 The MD5 cryptographic algorithm is not reversible.PHP can encrypt any word into MD5,&#8230;<\/p>\n","protected":false},"author":1,"featured_media":76,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"categories":[15],"tags":[],"class_list":["post-48","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacking"],"taxonomy_info":{"category":[{"value":15,"label":"Hacking"}]},"featured_image_src_large":["https:\/\/infosecscout.com\/wp-content\/uploads\/2019\/02\/Vignette-MD5-2.png",292,133,false],"author_info":{"display_name":"Patrick Fromaget","author_link":"https:\/\/infosecscout.com\/about\/"},"comment_info":0,"category_info":[{"term_id":15,"name":"Hacking","slug":"hacking","term_group":0,"term_taxonomy_id":15,"taxonomy":"category","description":"Ready to level up? Our Hacking Guides have you covered with step-by-step instructions on using tools like Hashcat. It's hacking made simple and fun!","parent":0,"count":15,"filter":"raw","cat_ID":15,"category_count":15,"category_description":"Ready to level up? Our Hacking Guides have you covered with step-by-step instructions on using tools like Hashcat. It's hacking made simple and fun!","cat_name":"Hacking","category_nicename":"hacking","category_parent":0}],"tag_info":false,"_links":{"self":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/48","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/comments?post=48"}],"version-history":[{"count":11,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/48\/revisions"}],"predecessor-version":[{"id":461,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/48\/revisions\/461"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/media\/76"}],"wp:attachment":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/media?parent=48"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/categories?post=48"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/tags?post=48"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}