MD5 and SHA-256 both squeeze any input into a fixed-size fingerprint — but only one of them still deserves your trust. Here is how cryptographic hashes work, why MD5 and SHA-1 collapsed under real-world attacks, and which algorithm to reach for in 2026.
What a cryptographic hash guarantees
A hash function maps data of any length to a fixed-size digest. Four properties make it cryptographic:
| Property | Meaning |
|---|---|
| Deterministic | The same input always produces the same digest, on any machine, forever. |
| Fixed size | A one-line note and a 4 GB file yield digests of identical length. |
| One-way | Preimage resistance: no practical way to reconstruct an input from its digest. |
| Avalanche effect | Flipping one input bit changes about half of the output bits — the digests look unrelated. |
The avalanche effect in action, via MD5: md5("hello") is 5d41402abc4b2a76b9719d911017c592, while md5("Hello") is 8b1a9953c4611296a827abf8c47804d7 — one capitalized letter, and the digests share almost nothing. Likewise sha256("abc") is the constant ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad on every correct implementation.
MD5 vs SHA-1 vs SHA-256: the numbers
| Algorithm | Published | Digest size | Collision status | Speed |
|---|---|---|---|---|
| MD5 | 1992 (RFC 1321) | 128 bits · 32 hex chars | Broken since 2004; collisions in seconds | Fastest in pure software |
| SHA-1 | 1995 | 160 bits · 40 hex chars | Broken: first public collision in 2017 | Fast |
| SHA-256 | 2001 (SHA-2 family) | 256 bits · 64 hex chars | None known; 128-bit resistance | Fast; hardware-accelerated on modern CPUs |
| SHA-384 | 2001 | 384 bits · 96 hex chars | None known; 192-bit resistance | Moderate |
| SHA-512 | 2001 | 512 bits · 128 hex chars | None known; 256-bit resistance | Often beats SHA-256 on 64-bit CPUs |
Collision resistance for an n-bit hash tops out at n/2 bits by the birthday bound, which is why even an unbroken 128-bit digest like MD5 could never offer more than 64-bit security. Speed is no excuse for weak choices either: MD5 is only about twice as fast as SHA-256 in pure software, and Intel, AMD and ARM processors all accelerate SHA-2 in hardware, so real-world gaps are small.
The collision history: how MD5 and SHA-1 fell
MD5: broken in 2004, weaponized by Flame
Ronald Rivest designed MD5 in 1991. In 2004, Xiaoyun Wang's team demonstrated the first practical collisions; by 2008 researchers used the technique to mint a rogue certificate-authority certificate trusted by every browser. In 2012 the Flame espionage malware forged a Microsoft code-signing certificate through an MD5 collision and spread through Windows Update. Today an identical-prefix collision takes seconds on a laptop and chosen-prefix attacks are routine — MD5 has zero collision resistance left.
SHA-1: SHAttered in 2017
SHA-1's weaknesses were theoretical from 2005 until 23 February 2017, when Google and CWI Amsterdam published SHAttered: two different PDFs with one identical SHA-1 digest, produced after roughly 2^63 hash computations — about 6,500 CPU-years, or 110 GPU-years. By 2020 a chosen-prefix collision cost around $45,000 of rented GPU time; NIST and every major browser had already retired SHA-1 certificates. Git still identifies objects by SHA-1 but is migrating to SHA-256.
What to use in 2026
Default to SHA-256. File integrity, TLS certificates, digital signatures, content addressing and blockchains all standardized on it, no practical attack exists, and support is universal — including the Web Crypto API in every browser. Pick SHA-384 or SHA-512 for a larger security margin or 64-bit systems where SHA-512 is faster.
MD5 is still acceptable when the threat is accidents, not attackers: spotting a corrupted download, de-duplicating backups, cache keys and ETags. The test is simple — if anyone gains anything by crafting a collision, MD5 and SHA-1 are disqualified; if you are only guarding against random bit rot, MD5's speed is harmless. Verify a download with shasum -a 256 file.iso or openssl dgst -sha256 file.iso, never against a published MD5 alone.
Passwords: never a fast hash
Everything that makes MD5 and SHA-256 good checksums — speed and determinism — makes them catastrophic for passwords. A single gaming GPU tries tens of billions of MD5 candidates, and billions of SHA-256 candidates, per second, so a leaked database of unsalted fast hashes falls to brute force and rainbow tables within hours. Password storage instead requires deliberately expensive, salted key-derivation functions:
- bcrypt (1999): Blowfish-based with a configurable cost factor; still widely deployed.
- scrypt (2009): adds memory hardness, raising the price of GPU and ASIC attacks.
- Argon2 (winner of the 2015 Password Hashing Competition, standardized as RFC 9106): the current recommendation — use the Argon2id variant.
All three store a random salt beside each digest and let you raise the work factor as hardware improves. "SHA-256 of the password" is never the right schema.
HMAC: integrity with a key
A bare digest proves data was not corrupted, but says nothing about who produced it — anyone can recompute a hash. To authenticate a message, use HMAC (RFC 2104), which folds a secret key into two nested hash rounds: H((key XOR opad) + H((key XOR ipad) + message)). HMAC-SHA256 is immune to the length-extension attacks that break naive hash(secret + message) schemes, and it powers JWT HS256 tokens and AWS-style API request signatures. In the browser, via Web Crypto:
const key = await crypto.subtle.importKey(
"raw", new TextEncoder().encode(secret),
{ name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
const mac = await crypto.subtle.sign("HMAC", key, data);The Hash Generator above computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 locally in your browser, so you can compare all five digests side by side.