Is MD5 still safe for anything?

For non-security uses, yes: checksums where nobody is attacking you, hash-table keys, and deduplication. The moment an adversary could benefit from a collision — file integrity, signatures, certificates — MD5 is disqualified. When in doubt, use SHA-256; it costs little more.

Why is SHA-1 not secure?

Researchers demonstrated a practical collision in 2017 (the SHAttered attack): two different PDFs with the same SHA-1 hash. That breaks the core promise — that a hash uniquely identifies its input — so SHA-1 must not be used for signatures, certificates, or integrity where attackers exist.

What's the difference between hashing and encryption?

Encryption is reversible with a key (you encrypt to hide, decrypt to read). Hashing is one-way: there is no "unhash" operation, and the same input always gives the same fixed-size output. Hashing verifies integrity and stores password verifiers; encryption protects confidentiality.

Can two files have the same hash?

Theoretically yes (pigeonhole principle: infinite inputs, finite outputs), but for SHA-256 finding such a pair is computationally infeasible — that's precisely what "collision resistant" means. For MD5 and SHA-1, attackers have actually done it, which is why they're retired from security use.

Which hash should I use for passwords?

None of the general-purpose hashes — not MD5, not SHA-256. Passwords need slow, salted, memory-hard functions: Argon2id (modern default), bcrypt, or PBKDF2. Fast hashes like SHA-256 let attackers try billions of guesses per second; password hashes are deliberately expensive to compute.

How do I check a download's checksum?

On Linux/macOS run `sha256sum filename` (or `shasum -a 256`); on Windows use `certutil -hashfile filename SHA256`. Compare the output character-for-character with the hash published by the vendor. Any difference — even one character — means the file is corrupted or tampered with; don't run it.

What's the fastest secure hash?

Among widely supported options, BLAKE2/BLAKE3 are faster than SHA-256 while remaining secure — but SHA-256 has universal tooling (every OS ships a verifier), so it's the pragmatic default unless you've benchmarked a real bottleneck.

MD5 vs SHA-1 vs SHA-256 vs SHA-512: Which Hash Algorithm to Use

September 26, 2026 · Security

MD5, SHA-1, SHA-256, SHA-512 — every download page and API doc throws hash names at you, and the advice is usually just "MD5 bad, SHA-256 good". This guide explains why: what a collision actually is, which properties each algorithm lost, and — the point most comparisons fumble — why none of them belong near passwords.

What a hash function is, in plain words

A hash function takes any input and produces a fixed-size fingerprint. Three properties matter:

Deterministic — same input, same output, every time.
Avalanche effect — flip one input bit and ~half the output bits change. Similar inputs produce wildly different hashes.
One-way — you can't reconstruct the input from the output (for secure hashes, trying every possibility is infeasible).

Security then demands two resistance properties: collision resistance (nobody can find two inputs with the same hash) and preimage resistance (given a hash, nobody can find any input producing it). The story of MD5 and SHA-1 is the story of losing the first one.

MD5: fast but broken — what "collision" means

MD5 produces a 128-bit hash (32 hex characters). It's extremely fast and still fine for non-adversarial jobs like checksumming files you control or keying hash tables. But researchers can now generate two different files with the same MD5 hash — a collision — on commodity hardware. Practical consequence: if you trust "same MD5 = same file" against an attacker, they can hand you a malicious file wearing an innocent file's hash. That's why browsers, certificates, and signatures abandoned it years ago.

SHA-1: the SHAttered lesson

SHA-1 (160-bit, 40 hex chars) was MD5's successor — until February 2017, when Google's SHAttered attack produced two different PDFs with identical SHA-1 hashes, at a then-feasible computation cost (later work made it far cheaper). The lesson wasn't just "SHA-1 is dead"; it was that theoretical weaknesses become practical ones on a predictable schedule. Migrate off broken hashes early, because attacks only get cheaper. SHA-1 today belongs in the same museum as MD5: fine for legacy identification, never for security.

SHA-256 and SHA-512: the current safe defaults

The SHA-2 family (SHA-256: 256-bit/64 hex chars; SHA-512: 512-bit/128 hex chars) has no practical attacks after two decades of scrutiny. SHA-256 is the universal default — every OS ships a verifier, every language has it built in. SHA-512 is faster on 64-bit CPUs and stronger on paper, but for most uses SHA-256's 256-bit margin is already far beyond brute force. Pick SHA-256 unless you have a measured reason not to.

Side-by-side comparison

Algorithm	Output	Hex length	Collision status	Use for
MD5	128-bit	32	Broken (practical)	Non-security checksums only
SHA-1	160-bit	40	Broken (SHAttered, 2017)	Legacy identification only
SHA-256	256-bit	64	Secure	Default: checksums, integrity, signatures
SHA-512	512-bit	128	Secure	High-margin needs, 64-bit speed

Hash identification trick: count the hex characters. 32 = MD5, 40 = SHA-1, 64 = SHA-256, 128 = SHA-512. It won't tell you the algorithm with certainty, but it narrows the field instantly when staring at an unknown checksum.

Compare them live: hash any text with MD5, SHA-1, SHA-256, and SHA-512 side by side in our free Hash Generator — entirely in your browser.

Which to use when — and why not passwords

File checksums / download verification: SHA-256. Universal tooling, no attacks.
Data integrity in transit: SHA-256 (or HMAC-SHA-256 when a key is involved).
Digital signatures / certificates: SHA-256 minimum; the signature scheme matters as much as the hash.
Deduplication, hash tables, etags: MD5 is acceptable — no adversary, speed wins.
Passwords: NONE of these. General-purpose hashes are fast by design — billions of guesses per second on a GPU. Password storage needs the opposite: slow, salted, memory-hard functions like Argon2id, bcrypt, or PBKDF2. "SHA-256(password)" is barely better than plaintext against a serious attacker. This is the most dangerous misunderstanding in the field — now you don't have it.

How to verify a file checksum

Vendor publishes app-2.4.tar.gz and its SHA-256. After downloading:

# Linux
sha256sum app-2.4.tar.gz
# macOS
shasum -a 256 app-2.4.tar.gz
# Windows (PowerShell)
certutil -hashfile app-2.4.tar.gz SHA256

Compare the output to the published hash character by character — eyeballing the first few characters isn't verification. Match means the file is intact and authentic (assuming you got the hash from a trustworthy channel); any mismatch means don't run it, re-download from the official source.

Frequently asked questions

Is MD5 still safe for anything?: For non-security uses, yes: checksums where nobody is attacking you, hash-table keys, and deduplication. The moment an adversary could benefit from a collision — file integrity, signatures, certificates — MD5 is disqualified. When in doubt, use SHA-256; it costs little more.
Why is SHA-1 not secure?: Researchers demonstrated a practical collision in 2017 (the SHAttered attack): two different PDFs with the same SHA-1 hash. That breaks the core promise — that a hash uniquely identifies its input — so SHA-1 must not be used for signatures, certificates, or integrity where attackers exist.
What's the difference between hashing and encryption?: Encryption is reversible with a key (you encrypt to hide, decrypt to read). Hashing is one-way: there is no "unhash" operation, and the same input always gives the same fixed-size output. Hashing verifies integrity and stores password verifiers; encryption protects confidentiality.
Can two files have the same hash?: Theoretically yes (pigeonhole principle: infinite inputs, finite outputs), but for SHA-256 finding such a pair is computationally infeasible — that's precisely what "collision resistant" means. For MD5 and SHA-1, attackers have actually done it, which is why they're retired from security use.
Which hash should I use for passwords?: None of the general-purpose hashes — not MD5, not SHA-256. Passwords need slow, salted, memory-hard functions: Argon2id (modern default), bcrypt, or PBKDF2. Fast hashes like SHA-256 let attackers try billions of guesses per second; password hashes are deliberately expensive to compute.
How do I check a download's checksum?: On Linux/macOS run `sha256sum filename` (or `shasum -a 256`); on Windows use `certutil -hashfile filename SHA256`. Compare the output character-for-character with the hash published by the vendor. Any difference — even one character — means the file is corrupted or tampered with; don't run it.
What's the fastest secure hash?: Among widely supported options, BLAKE2/BLAKE3 are faster than SHA-256 while remaining secure — but SHA-256 has universal tooling (every OS ships a verifier), so it's the pragmatic default unless you've benchmarked a real bottleneck.