They are not impossible to decode, but md5 has a collision which makes it
less secure.
Although, for all practical purposes -- if you are running an application that people will try to hack (and spend the time and effort to find a powerful enough computer to find a collision) then you really shouldn't be using md5 in the first place
As mentioned about, md5 is not an encryption algorithm, it is a one-way hash. What this means is, md5 is a mechanism that when fed the same plain text, it will always generate the same cryptext (a collision, in plain terms, happens when two different plain texts generate the same cryptext).
To verify two unknowns, you run then through the md5 and check the cryptext. If it is the same, you know the plain text was the same.
You cannot get the plain text from the cryptext (that is why it is called one-way).
If you want two-way, then use a proper encryption algorigthm.