Pattern

Regex for MD5 hash

32-character MD5 hash.

The MD5 hash regex is ^[0-9a-fA-F]{32}$ — copy it below, or open it in the explainer for a token-by-token breakdown.

The pattern

^[0-9a-fA-F]{32}$

Try in explainer → Download cheat sheet ↓

What it matches

5d41402abc4b2a76b9719d911017c592
D41D8CD98F00B204E9800998ECF8427E

What it doesn't match

short
5d41402abc4b2a76b9719d911017c5

Notes & gotchas

32 hex digits. MD5 is cryptographically broken — never use for security, but it's common as a file checksum or cache key.

Code in your language

Use the explainer's Code tab to generate ready-to-paste snippets in JavaScript, Python, Java, .NET, Go, Ruby, and PHP for this pattern.

Open in explainer →

Token-by-token breakdown

Every part of the pattern, left to right:

Token	Meaning
`^`	start of string (or line in multiline mode)
`[0-9a-fA-F]{32}`	exactly 32 times: any of: digits, a–f, A–F
`$`	end of string (or line in multiline mode)

About this pattern

Identifier formats like UUIDs, hashes, and version strings have well-defined structures that regex captures cleanly. The pattern verifies format; checksums and validity against a registry need additional checks.

Quick usage in different languages

This exact pattern — with the correct escaping and idioms for each language:

JavaScript: /^[0-9a-fA-F]{32}$/.test(value)
Python: re.match(r"^[0-9a-fA-F]{32}$", value)
Java: Pattern.compile("^[0-9a-fA-F]{32}$").matcher(value).matches()
C# / .NET: Regex.IsMatch(value, @"^[0-9a-fA-F]{32}$")
Go: regexp.MustCompile(`^[0-9a-fA-F]{32}$`).MatchString(value)
Ruby: /^[0-9a-fA-F]{32}$/.match?(value)
PHP: preg_match('~^[0-9a-fA-F]{32}$~', $value)

The explainer’s Code tab regenerates these for any pattern you paste, and the downloadable cheat sheet bundles the breakdown, all seven snippets, and the pitfalls below onto one printable page.

Common pitfalls

Anchored to the whole string. This pattern uses ^ and $, so it requires the entire input to match. To find it inside a longer text, drop the anchors and use the global (g) flag.
Case sensitivity. Letter ranges are case-sensitive — use the i flag if the input case can vary.
Validate beyond format. Matching the format doesn't guarantee the value is real. Confirm the md5 hash against a source of truth (database, API, or checksum) where it matters.

Standards & sources

This pattern is based on the following authoritative specification(s) and issuing authorities. Formats can change — always confirm against the primary source.

RFC 1321 — The MD5 Message-Digest Algorithm

Related patterns

More patterns in the Codes & IDs category: