localize and don't leak cross-platform md5