MD5 lookup API documentation

Use the FMD5 API to query up to 100 unique MD5 hashes in one request. The endpoint authenticates with an API Key, returns only matched values, and charges one query credit for every unique MD5 submitted.

Endpoint
GET https://www.fmd5.com/api/query?key=YOUR_API_KEY&md5s=HASH_1,HASH_2

Quick start

Create an account, open the API Key section in the console, and keep the generated key on your server. Submit lowercase or uppercase 32-character hexadecimal MD5 values separated by commas.

curl --get 'https://www.fmd5.com/api/query' \
  --data-urlencode 'key=YOUR_API_KEY' \
  --data-urlencode 'md5s=202cb962ac59075b964b07152d234b70,81dc9bdb52d04dc20036dbd8313ed055'

Successful response

A successful request returns code: 0. The result object contains only hashes with a matching candidate value. A valid hash that is absent from the object was not found in the current dataset.

{
  "code": 0,
  "result": {
    "202cb962ac59075b964b07152d234b70": "123",
    "81dc9bdb52d04dc20036dbd8313ed055": "1234"
  }
}

Limits and error handling

Condition	Response	Client action
Success	`HTTP 200`, `code: 0`	Read matched values from `result`.
Insufficient account or project-key credits	`HTTP 200`, `code: -1`	Stop requests and recharge or increase the project-key quota.
More than 100 unique hashes	`HTTP 400`, `QUERY_LIMIT_EXCEEDED`	Deduplicate and split the input into batches of 100.
Invalid MD5 input	`HTTP 400`, `INVALID_MD5`	Accept only 32 hexadecimal characters per item.
Invalid API Key	`HTTP 401`, `INVALID_API_KEY`	Check that the key is active and has not been rotated.
Rate limit exceeded	`HTTP 429`, `RATE_LIMIT_EXCEEDED`	Wait for `Retry-After`, then retry in sequence.

Recommended batch strategy

Normalize hashes to lowercase, remove duplicates, split the list into groups of at most 100, and send one request at a time. Wait at least one second between requests. Concurrent or multi-threaded traffic may trigger automated IP protection.

for each batch of up to 100 unique hashes:
  response = query(batch)
  if response is HTTP 429:
    wait according to Retry-After
    retry the same batch
  else:
    save response.result
  wait at least 1 second

API Key security

The API uses a GET endpoint, so the key may appear in application, proxy or browser history logs. Call it from a controlled server environment, use HTTPS, redact the key parameter from logs, and never publish a real key in client-side JavaScript or documentation.

Use project API Keys to isolate integrations and assign a quota to each project. Rotate or revoke a key immediately when it is exposed. Do not send passwords, private keys, identity documents or data you are not authorized to process.

Meaning of lookup results

MD5 is a one-way digest, not reversible encryption. A returned value is a candidate plaintext whose MD5 matches the submitted digest; a miss only means no mapping is available in the current dataset. Recalculate MD5 locally before using a result in an important workflow. Read the MD5 lookup FAQ for limitations, salted hashes and security guidance.