MD5 vs SHA-1 vs SHA-256: Which Hash Function Should You Use?

MD5 and SHA-1 are cryptographically broken and must not be used for security purposes. Use SHA-256 for general data integrity and digital signatures, SHA-512 for high-security applications, bcrypt or Argon2 for password hashing. Never use MD5 or SHA-1 for any new security-critical implementation.

What Is a Cryptographic Hash Function?

A hash function takes arbitrary input and produces a fixed-length digest. Good cryptographic hash functions have three properties:

1. Pre-image resistance: Given hash H, you cannot find input M such that hash(M) = H
2. Second pre-image resistance: Given M1, you cannot find a different M2 where hash(M1) = hash(M2)
3. Collision resistance: You cannot find any two different inputs that produce the same hash

When these properties break down, the algorithm is considered cryptographically broken.

MD5

MD5 was designed by Ron Rivest in 1991 and produces a 128-bit (32 hex character) digest.

MD5("hello") = 5d41402abc4b2a76b9719d911017c592

Status: Broken. Do not use for security.

Practical MD5 collisions were demonstrated in 2004. By 2008, researchers created a rogue CA certificate using MD5 collisions. MD5 is so compromised that collision attacks take seconds on consumer hardware.

MD5 is acceptable only for:

• Non-security checksums (detecting accidental file corruption)
• Legacy system compatibility where migration is impossible
• Hash tables and data structures (non-security)

SHA-1

SHA-1 was developed by the NSA and NIST in 1995 and produces a 160-bit (40 hex character) digest.

SHA1("hello") = aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d

Status: Broken. Do not use for security.

Theoretical attacks on SHA-1 were identified in 2005. In 2017, Google's SHAttered attack demonstrated the first practical SHA-1 collision, producing two different PDF files with the same SHA-1 hash. The cost was approximately $110,000 in cloud compute.

Browser vendors removed SHA-1 certificate support in 2017. Git is in the process of migrating from SHA-1 to SHA-256.

SHA-1 is acceptable only for:

• Git object addressing (legacy, being deprecated)
• HMAC-SHA1 has slightly different properties — still used in some TOTP (HOTP) implementations
• Non-security checksums where MD5 is already in use

SHA-256

SHA-256 is part of the SHA-2 family (NIST, 2001) and produces a 256-bit (64 hex character) digest.

SHA256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

Status: Secure. Recommended for general use.

No practical attacks on SHA-256 exist. The 256-bit output provides 128 bits of collision resistance (birthday bound), which is sufficient against current classical computing.

// Web Crypto API (browser + Node.js 15+)
async function sha256(message) {
  const msgBuffer = new TextEncoder().encode(message);
  const hashBuffer = await crypto.subtle.digest("SHA-256", msgBuffer);
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  return hashArray.map(b => b.toString(16).padStart(2, "0")).join("");
}

const hash = await sha256("hello");
// "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"

Use SHA-256 for:

• File integrity verification (checksums)
• Digital signatures (TLS, code signing)
• HMAC message authentication
• Blockchain and Merkle trees
• Password hashing? No — use bcrypt or Argon2 (see below)

SHA-512

SHA-512 is also in the SHA-2 family, producing a 512-bit (128 hex character) digest.

const hashBuffer = await crypto.subtle.digest("SHA-512", msgBuffer);

Use SHA-512 when:

• You need resistance against length-extension attacks (SHA-256 is vulnerable; SHA-512/256 is not)
• Dealing with very large datasets where the extra collision resistance margin matters
• Your platform has native 64-bit operations making SHA-512 faster than SHA-256

On 64-bit systems, SHA-512 is often faster than SHA-256 for large inputs because it processes 1024-bit blocks vs SHA-256's 512-bit blocks, making each round cover more data.

SHA-3

SHA-3 (Keccak, NIST 2015) uses a completely different sponge construction than SHA-2.

SHA3-256 output: 1af17a664e3fa8e419b8ba05c2a173169df76162a5a286e0c405b460d478f7ef

SHA-3 is not faster than SHA-2 in software but provides algorithm diversity — if a weakness were found in SHA-2's Merkle-Damgård construction, SHA-3 would be unaffected.

Use SHA-3 when: your threat model requires defense against unknown weaknesses in SHA-2, or when compatibility with specific standards requires it.

bcrypt for Passwords

Raw hash functions (even SHA-256) are fast by design — a GPU can compute billions of SHA-256 hashes per second. For password storage, you need a function that is intentionally slow.

bcrypt incorporates a cost factor that controls computational expense:

import bcrypt from "bcrypt";

const COST = 12; // 2^12 = 4096 iterations (~250ms on modern hardware)

// Hash
const hash = await bcrypt.hash("user_password", COST);
// "$2b$12$..." — 60-character string including salt

// Verify
const isValid = await bcrypt.compare("user_password", hash);

bcrypt limitations:

• Truncates passwords at 72 bytes
• Maximum output is 60 characters
• Not parallelizable (intentional)

Increase the cost factor as hardware improves. A 250ms hash time is a reasonable target for login forms.

Argon2 for New Projects

Argon2 won the Password Hashing Competition in 2015 and is the current recommendation for new systems.

import argon2 from "argon2";

// Hash
const hash = await argon2.hash("user_password", {
  type: argon2.argon2id,  // Recommended variant
  memoryCost: 65536,       // 64 MB
  timeCost: 3,             // 3 iterations
  parallelism: 4,          // 4 threads
});

// Verify
const isValid = await argon2.verify(hash, "user_password");

Argon2id combines memory-hardness with data-dependent access patterns, resisting both GPU attacks and side-channel attacks. For new password storage systems, prefer Argon2id over bcrypt.

Comparison Table

Algorithm	Output Bits	Speed	Broken?	Use For
MD5	128	Very fast	Yes	Legacy checksums only
SHA-1	160	Fast	Yes	Nothing new
SHA-256	256	Fast	No	Integrity, signatures, HMAC
SHA-512	512	Fast (64-bit)	No	High-security integrity
SHA-3-256	256	Moderate	No	Algorithm diversity
bcrypt	184	Slow (adjustable)	No	Password storage
Argon2id	Variable	Slow (adjustable)	No	Password storage (new projects)
BLAKE3	256	Very fast	No	High-speed checksums

Hashing vs. Encryption

Hash functions are one-way — you cannot reverse a hash to get the original input. Encryption is two-way — with the key, you can decrypt. Never confuse these:

• Store passwords as hashes (bcrypt/Argon2), not encrypted
• Use hashes for data integrity checks
• Use encryption (AES-256-GCM) when you need to retrieve the original data

Try It Now

Calculate SHA-256, SHA-512, and MD5 hashes in your browser with the Hash Generator Tool — all computation is local, no data is sent to any server.

More Tools from Cosyslabs

• PDF Convert All — Merge, compress, and convert PDFs. Checking the SHA-256 hash of a downloaded PDF against a publisher-provided checksum is the standard way to verify file integrity before opening.
• Unit Convert All — Convert data storage units when reasoning about hash output sizes and the volume of data you're checksumming.
• Rough Estimator — Estimate the engineering cost of migrating legacy MD5-based systems to SHA-256 or Argon2.
• Cosyslabs — The studio behind Dev Tools !, Routine Toolkit, Astrilio, CastFleet, and more.