MD5 vs SHA-256: Choosing the Right Hash Algorithm

Cryptographic hash functions are everywhere — in password storage, file integrity, digital signatures, blockchain, and content addressing. But not all hashes are created equal, and using a broken algorithm for a security purpose is a classic vulnerability. This article explains the difference between MD5, SHA-1, and the SHA-2 family, and why hashing a password is a fundamentally different task from hashing a file.

What a hash function does

A cryptographic hash function takes an input of any size and produces a fixed-length fingerprint called a digest. A secure hash has four key properties:

• Deterministic — the same input always produces the same output.
• Fast to compute — for any given input.
• One-way — it is infeasible to reconstruct the input from the digest.
• Collision-resistant — it is infeasible to find two different inputs that produce the same digest.
• Avalanche effect — a one-bit change in the input changes the output completely.

You can generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 digests with the Hash Generator and observe these properties directly.

The algorithms

Algorithm	Output length	Status	Typical use
MD5	128 bits (32 hex)	Broken	Non-security checksums only
SHA-1	160 bits (40 hex)	Broken	Legacy, migration target
SHA-256	256 bits (64 hex)	Secure	General purpose, blockchain, TLS
SHA-384 / SHA-512	384 / 512 bits	Secure	Higher-assurance applications

MD5

MD5 was the workhorse of the 1990s and early 2000s, used for file checksums, password storage (sadly), and digital certificates. Researchers demonstrated practical collisions in the early 2000s, meaning an attacker can craft two different inputs that produce the same MD5 digest. This breaks the integrity guarantee MD5 was relied on for. MD5 must not be used for any security purpose. It remains acceptable for non-adversarial checksums — detecting accidental corruption of a trusted file — but nothing more.

SHA-1

SHA-1 followed a similar trajectory. It powered Git’s object model and TLS certificates for years, but collisions became practical (Google’s SHAttered attack in 2017 demonstrated a real collision). Git has been migrating away from SHA-1, and certificate authorities stopped issuing SHA-1 certificates. Like MD5, SHA-1 should not be used for new security-sensitive applications.

SHA-2 (SHA-256, SHA-384, SHA-512)

The SHA-2 family is currently secure and is the recommended choice for virtually every security application. SHA-256 produces a 64-character hex digest and is the current industry standard, used in TLS certificates, Bitcoin, code signing, and HMAC-based request signing. SHA-384 and SHA-512 offer larger digests for applications that want extra margin. No practical attacks against SHA-2 exist today.

Hashing files vs hashing passwords

This is the distinction that catches the most developers. File hashing and password hashing are different problems with different solutions.

File hashing

When you hash a file to verify its integrity, you want a fast, collision-resistant function. SHA-256 is ideal: it is fast to compute, so verifying a large download is quick, and collision-resistant, so an attacker cannot substitute a malicious file with the same digest. Software distributors publish SHA-256 checksums alongside downloads so you can confirm the file you received is the file they shipped.

Password hashing

When you hash a password for storage, fast is the enemy. If an attacker steals the password database, they mount an offline brute-force attack: hash candidate passwords and compare. A fast hash like SHA-256 lets an attacker try billions of candidates per second on a GPU.

Password storage requires a deliberately slow, salted algorithm:

• bcrypt — adaptive cost factor, battle-tested.
• scrypt — memory-hard, expensive to attack on GPUs.
• Argon2 — the current recommendation, winner of the Password Hashing Competition.

These algorithms add a per-user salt (so identical passwords hash differently) and a tunable cost (so hashing gets slower as hardware gets faster). Never store passwords with plain MD5, SHA-1, or even SHA-256 — use a dedicated password-hashing function. Generate strong, unique passwords in the first place with the Password Generator.

Practical guidance

• For file integrity and checksums, use SHA-256. MD5 is acceptable only for non-adversarial corruption detection.
• For digital signatures and certificates, use SHA-256 or stronger. Avoid SHA-1 entirely.
• For password storage, use bcrypt, scrypt, or Argon2 — never raw SHA-256.
• For content addressing (Git-style identifiers), SHA-256 is a solid choice; SHA-1 is legacy.
• For request signing (HMAC), use HMAC-SHA256 — never reuse a raw hash over a secret.

Verify before you trust

A digest is only useful if you can compare it to a trusted source. When you download a file, always compare the published SHA-256 checksum against the one you compute locally. The Hash Generator lets you compute the digest of any text input in your browser — and because it runs locally, the input never leaves your device.

The one-line summary: MD5 and SHA-1 are broken — use SHA-256 for everything except passwords, and use bcrypt or Argon2 for passwords.