Crypto · Comparison · Guide

MD5 vs SHA-256

Both produce a short fingerprint of arbitrary data. One is still safe for security-sensitive work; the other has been broken for over a decade.

MD5 of “The quick brown fox jumps over the lazy dog”
9e107d9d372bb6826bd81d3542a419d6
SHA-256 of “The quick brown fox jumps over the lazy dog”
d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

What a Hash Does

A cryptographic hash collapses arbitrary input into a fixed-size fingerprint. For a good hash, you cannot deduce the input from the digest, and you cannot find two inputs that produce the same digest (collision resistance).

MD5 (128 bits)

MD5 is cryptographically broken. Practical collisions have been demonstrated since 2004, including chosen-prefix attacks against real X.509 certificates. Treat MD5 as a non-adversarial checksum only — fine for deduplication or caching keys, never for security.

SHA-1 (160 bits)

Also broken. The SHAttered attack (2017) produced the first public SHA-1 collision. Browsers no longer accept SHA-1 certificates. Avoid for new systems; migrate legacy uses where feasible.

SHA-256 and SHA-512 (SHA-2)

Still considered secure against collision and preimage attacks. SHA-256 is ubiquitous in TLS, Bitcoin, Git (as of SHA-256 support), code signing, and package integrity. SHA-512 produces a larger digest and is often faster on 64-bit CPUs.

What You Should Use

  • Download checksums: SHA-256 (never MD5)
  • Git-style content IDs: SHA-256 for new systems
  • HMAC / signatures: SHA-256 or SHA-512
  • Password storage: none of the above — use Argon2, bcrypt, or scrypt
  • Non-security dedup: MD5 or xxHash are fine

Try It

Compute MD5 and the full SHA family of any string with our free Hash Generator.

MD5 is broken

Only safe for non-adversarial checksums.

SHA-256 is the baseline

Default for integrity and signatures today.

Passwords need KDFs

Use Argon2 / bcrypt / scrypt, never a plain hash.