md5_file()

The PHP md5_file() function reads a file and returns the MD5 hash of its contents as a 32-character hexadecimal string. Unlike md5(), which hashes a string you already hold in memory, md5_file() streams the file from disk for you — so you can fingerprint a file of any size without loading the whole thing into a variable first.

This page covers the syntax, both output modes, the practical jobs md5_file() is good at (integrity checks, change detection, deduplication), the gotchas to watch for, and where MD5 is the wrong tool.

Syntax

md5_file(string $filename, bool $binary = false): string|false

Return value: the MD5 hash on success, or false if the file cannot be read. (Before PHP 8.0 the second argument was named $raw_output.)

Basic example

The hash is computed from the file's bytes, so a file containing exactly the text Hello, World! (no trailing newline) always produces the same digest:

Output:

65a8e27d8879283831b664bd8b7f0ad4

Because MD5 is deterministic, hashing the same content anywhere — on any machine, in any language — yields this identical value. That property is what makes it useful for the cases below.

Verifying file integrity

The most common use is confirming a downloaded file matches a published checksum. Compare the hash you compute against the expected value with hash_equals() (a timing-safe comparison) rather than ==:

<?php
$expected = "65a8e27d8879283831b664bd8b7f0ad4";
$actual   = md5_file("example.txt");

if ($actual === false) {
    echo "Could not read the file.";
} elseif (hash_equals($expected, $actual)) {
    echo "File is intact.";
} else {
    echo "File is corrupted or has been modified.";
}
?>

Detecting changes and deduplicating

Storing a file's hash lets you cheaply detect whether it changed later: re-hash it and compare to the stored value. Two files with the same hash are (with overwhelming probability) byte-for-byte identical, which makes md5_file() handy for spotting duplicates:

<?php
$a = md5_file("photo1.jpg");
$b = md5_file("photo2.jpg");

echo ($a === $b) ? "Duplicate files\n" : "Different files\n";
?>

Raw binary output

Pass true as the second argument to get the 16 raw bytes instead of 32 hex characters. This is useful when you need to store the hash compactly in a fixed-width BINARY(16) database column:

<?php
$raw = md5_file("example.txt", true);

echo strlen($raw);        // 16 (bytes) instead of 32 (hex chars)
echo bin2hex($raw);       // 65a8e27d8879283831b664bd8b7f0ad4
?>

Handling errors

If the path is missing or unreadable, md5_file() returns false and emits a warning. Always check for a missing file before hashing so you can report a clean error:

<?php
$filename = "example.txt";

if (!is_readable($filename)) {
    echo "File not found or not readable.";
} else {
    echo md5_file($filename);
}
?>

When not to use MD5

MD5 is fast and fine for non-security tasks like change detection, caching keys, and deduplication. It is broken for security: attackers can craft two different files with the same MD5 hash (a collision). Do not use it to:

• store passwords (use password_hash()),
• guard against a malicious party tampering with a file.

For tamper-resistant fingerprints, prefer a SHA-2 family digest via hash_file():

<?php
echo hash_file("sha256", "example.txt");
?>

Related functions

• md5() — hash a string instead of a file.
• sha1_file() — SHA-1 hash of a file's contents.
• crc32() — fast 32-bit checksum for error detection.
• file_get_contents() — read a whole file into a string.

Summary

md5_file() returns the MD5 digest of a file's contents — a hex string by default, or raw binary with $binary = true. It is ideal for integrity verification, change detection, and deduplication, but should never be relied on for security-sensitive work, where a SHA-2 hash via hash_file() is the right choice.

Practice