MD5 vs SHA-1 vs SHA-256: Which Hash Algorithm Should You Use?

What Hash Functions Do

A cryptographic hash function takes an input of any size and produces a fixed-size output called a digest or hash. The function has several required properties:

• Deterministic: The same input always produces the same output.
• Fast to compute: For any given input, computing the hash is quick.
• Pre-image resistant: Given a hash, it should be infeasible to find any input that produces it.
• Second pre-image resistant: Given an input and its hash, it should be infeasible to find a different input with the same hash.
• Collision resistant: It should be infeasible to find any two different inputs that produce the same hash.

The last two properties are where MD5 and SHA-1 fail. When these properties break down, the security of any system relying on them is compromised.

MD5: Fast but Broken

MD5 (Message Digest Algorithm 5) was designed by Ron Rivest in 1991. It produces a 128-bit (32 hex character) digest and was widely used for checksums, password hashing, and certificate fingerprints through the 1990s and 2000s.

The problems became apparent in 2004, when Chinese researchers demonstrated practical MD5 collision attacks. By 2008, researchers created a rogue certificate authority certificate using MD5 collisions, demonstrating a real-world attack against HTTPS. Today, MD5 collision attacks can be found in seconds on commodity hardware.

RFC 6151 (Updated Security Considerations for MD5) formally documents the security weaknesses and explicitly recommends against using MD5 for any security application.

Despite this, MD5 remains prevalent in legacy systems, non-security checksums, and quick fingerprinting tasks where collision resistance is not required.

SHA-1: Deprecated

SHA-1 (Secure Hash Algorithm 1), developed by the NSA and published by NIST in 1995, produces a 160-bit (40 hex character) digest. It was the dominant algorithm for TLS certificates, code signing, and digital signatures for over a decade.

Theoretical weaknesses in SHA-1 were identified in 2005. In 2017, Google's research team published SHAttered — the first practical SHA-1 collision, achieved with approximately 6,500 CPU-years of computation. By 2020, chosen-prefix collision attacks against SHA-1 became feasible with cloud computing resources.

NIST formally deprecated SHA-1 for most applications, and all major browsers stopped accepting SHA-1 TLS certificates by 2017. See also the Wikipedia SHA-1 article for a detailed history of the attacks.

SHA-256: The Current Standard

SHA-256 is part of the SHA-2 family, also developed by the NSA and published by NIST. It produces a 256-bit (64 hex character) digest. SHA-256 has been the recommended replacement for SHA-1 since NIST's 2011 migration deadline.

No practical attacks against SHA-256 collision resistance are known. The best theoretical attacks (generic birthday attacks) would require approximately 2¹²⁸ operations — a number beyond the reach of any foreseeable computing technology, including quantum computers (which would reduce this to 2⁶⁴ operations, still impractical for well-designed systems).

SHA-256 is used in Bitcoin's proof-of-work, TLS 1.3 certificates, code signing, and the vast majority of modern security applications. It is the safe default for any new implementation.

SHA-512 and SHA-3

SHA-512 is another member of the SHA-2 family, producing a 512-bit digest. It offers marginally more security margin and is actually faster than SHA-256 on 64-bit processors because its internal arithmetic is optimised for 64-bit operations. It is appropriate when a larger digest is required or when you are working primarily on 64-bit systems.

SHA-3 (based on the Keccak algorithm) was standardised by NIST in 2015 as an alternative to SHA-2. Its internal structure is entirely different from SHA-2, meaning vulnerabilities discovered in one family would not affect the other. SHA-3 is not yet as widely deployed as SHA-256, but it is a fully approved modern algorithm.

Comparison Table

Algorithm	Digest Size	Status	Collision Attack	Recommended For
MD5	128 bits	Broken	Practical (seconds)	Non-security checksums only
SHA-1	160 bits	Deprecated	Practical (cloud compute)	Legacy compatibility only
SHA-256	256 bits	Secure	None known	General security applications
SHA-512	512 bits	Secure	None known	64-bit systems, larger digest
SHA-3-256	256 bits	Secure	None known	Alternative to SHA-256

Use Cases: Which Algorithm for What?

Password Storage

Do not use any of the above algorithms directly for password storage. General-purpose hash functions are designed to be fast, which makes them easy to brute-force. Use a purpose-built password hashing algorithm like bcrypt, scrypt, or Argon2 (the winner of the Password Hashing Competition). These algorithms are intentionally slow and support configurable work factors.

File Integrity Verification

For verifying that a downloaded file matches a known-good copy: SHA-256 is preferred. MD5 is functionally acceptable only when both the file and hash come from the same source and you are protecting against accidental corruption (not tampering). For any security-sensitive download, require SHA-256 or SHA-512.

Digital Signatures

SHA-256 is the minimum for new digital signature implementations. SHA-1 is completely unacceptable — collisions have been demonstrated in practice. SHA-256 or SHA-384 (for TLS certificates) is the standard.

Data Fingerprinting and Deduplication

For non-security fingerprinting (e.g., detecting duplicate files in a storage system), MD5 or SHA-1 may still be practical due to their speed — but SHA-256 has become fast enough on modern hardware that there is little reason not to use it even here.

When MD5 is Still Acceptable

MD5 retains a limited set of acceptable use cases where cryptographic collision resistance is not required:

• Non-security checksums where the goal is detecting accidental bit corruption (not tampering)
• Internal database record fingerprinting where security is not a concern
• Legacy protocol compatibility where migration is not yet possible

In all new development, SHA-256 should be the default. The performance difference between MD5 and SHA-256 is negligible on modern hardware for most workloads.