Utilix knowledge base
MD5 vs SHA-256 — Choosing the Right Hash Algorithm
Published May 23, 2026
MD5 and SHA-256 are both cryptographic hash functions — algorithms that map an input of any size to a fixed-length output called a hash or digest. They were designed for different eras and have very different security profiles.
Output comparison
| Algorithm | Output length | Example (hash of "hello") |
|---|---|---|
| MD5 | 128 bits / 32 hex chars | 5d41402abc4b2a76b9719d911017c592 |
| SHA-256 | 256 bits / 64 hex chars | 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 |
Both produce a unique-looking fixed-length string for any input. Change one character in the input and the output changes completely (the avalanche effect).
Security comparison
| Property | MD5 | SHA-256 |
|---|---|---|
| Collision resistance | ❌ Broken (2004) | ✅ No known collisions |
| Pre-image resistance | ⚠️ Weakened | ✅ Strong |
| Second pre-image resistance | ⚠️ Weakened | ✅ Strong |
| Speed | Very fast | Fast (~3–5× slower than MD5) |
| GPU cracking resistance | ❌ Trivial with modern GPUs | ⚠️ Better, but not a password hash |
| NIST approved | ❌ Deprecated | ✅ Approved |
Collision means two different inputs produce the same hash. MD5 collisions can be generated in seconds on consumer hardware. This makes MD5 unsuitable for any security context where forgery resistance matters.
When MD5 is acceptable
MD5 is not inherently dangerous — the problem is using it for the wrong purpose. It remains fine when:
- Checksums for accidental corruption — verifying a downloaded file wasn't corrupted in transit (but not tampered with). Linux distros often still publish MD5 alongside SHA-256 for this reason.
- Non-cryptographic fingerprinting — deduplicating files in a database, cache-busting asset URLs, or generating ETags where collision risk is not a security concern.
- Internal tooling — fast content-addressable caching in build systems where an attacker cannot influence the inputs.
Do not use MD5 for:
- Digital signatures or certificates
- Verifying software authenticity (use SHA-256 or SHA-3)
- Password hashing (use bcrypt, scrypt, or Argon2)
- HMAC when the security of the system depends on collision resistance
When SHA-256 is the right choice
SHA-256 (part of the SHA-2 family, standardised in 2001) is the current default for most security-sensitive hashing:
- File integrity and software signatures — Git uses SHA-1 (being migrated to SHA-256); package registries like npm and PyPI use SHA-256 to verify downloads.
- TLS certificates — SHA-256 is the required hash algorithm in modern TLS certificate chains.
- HMAC-SHA-256 — the standard MAC algorithm in JWT (
HS256) and many API authentication schemes. - Bitcoin and blockchain — SHA-256 is used in Bitcoin's proof-of-work and block header hashing.
- General data integrity where tampering is a concern — anywhere an adversary might be able to craft a collision.
Neither is right for passwords
A critical misconception: neither MD5 nor SHA-256 should be used to hash passwords. Both are designed to be fast, which makes them vulnerable to brute-force and dictionary attacks via GPU cracking.
Password storage requires a slow, memory-hard algorithm:
| Algorithm | Recommended use |
|---|---|
| Argon2id | First choice for new systems (winner of Password Hashing Competition) |
| bcrypt | Widely supported, good track record, adjustable cost factor |
| scrypt | Memory-hard, good alternative to bcrypt |
| MD5 / SHA-256 | ❌ Never for passwords |
The SHA family at a glance
| Algorithm | Output | Status | Common use |
|---|---|---|---|
| MD5 | 128 bit | ❌ Broken | Legacy checksums only |
| SHA-1 | 160 bit | ❌ Deprecated | Legacy Git (being replaced) |
| SHA-256 | 256 bit | ✅ Current | TLS, code signing, HMAC |
| SHA-384 | 384 bit | ✅ Current | Higher-security TLS suites |
| SHA-512 | 512 bit | ✅ Current | High-security file integrity |
| SHA3-256 | 256 bit | ✅ Current | Alternative where SHA-2 is a concern |
Quick decision guide
Need to hash a password?
→ Use Argon2id, bcrypt, or scrypt. Never MD5 or SHA-256.
Need to verify a downloaded file?
→ SHA-256 (preferred) or MD5 (acceptable for corruption-only checks).
Need to sign a file or certificate?
→ SHA-256 minimum. SHA-384 for higher assurance.
Building an HMAC or API signature?
→ HMAC-SHA-256.
Need a fast non-security checksum or dedup key?
→ MD5 is fine. So is SHA-256.
Use the Hash Generator to compute MD5, SHA-256, SHA-512, and other digests instantly in your browser. See Choosing a Hash Algorithm for a broader comparison including SHA-1, SHA-3, and BLAKE2.