SHA-256 vs MD5: Hash Algorithms Explained for Developers

When comparing SHA-256 vs MD5, the short answer is: use SHA-256 for anything security-sensitive and MD5 only for non-security tasks like basic file checksums. But understanding why requires a closer look at how these algorithms differ, where each one is still appropriate, and which to reach for in specific real-world situations. This guide covers all of that with a side-by-side comparison table, concrete examples, and a quick-reference summary.

What a hash function is

A hash function takes an input of any length and produces a fixed-length output called a hash or digest. Three properties define a cryptographic hash function. First, it is deterministic: the same input always produces the same output. Second, it is one-way: given a hash, you cannot reconstruct the original input. Third, it is collision-resistant: it must be computationally infeasible to find two different inputs that produce the same hash.

These properties make hash functions useful for verifying data integrity (if the hash matches, the data has not changed), generating compact identifiers for large files, and verifying passwords without storing them. The difference between SHA-256 and MD5 comes down to how well each delivers on that third property, collision resistance, and how much computing power would be needed to break it.

SHA-256 vs MD5: side-by-side comparison

Here is how the four most widely used hash algorithms compare across the properties that matter when choosing between them:

Output size alone does not determine security. SHA-1 produces more bits than MD5 and is still broken. SHA-256 is the right default for any security-sensitive use today.

MD5: fast but cryptographically broken

MD5 produces a 128-bit hash represented as 32 hexadecimal characters. Designed in 1991, it was widely used through the 1990s and 2000s for checksums, digital signatures, and password storage. Researchers demonstrated practical collision attacks in the mid-2000s, and by 2008 real-world attacks were being used to forge SSL certificates.

A collision means two different inputs produce the same hash. In a security context this is serious: an attacker can craft a malicious file with the same MD5 hash as a trusted file, making it impossible to distinguish them by hash alone. MD5 is unsuitable for any security purpose.

MD5 remains appropriate for non-security uses: verifying a downloaded file was not corrupted during transfer (not maliciously tampered with), generating cache keys in a web application, deduplicating files by content, or producing short identifiers where uniqueness matters more than security. Many package managers and download sites still publish MD5 checksums alongside SHA-256 checksums for compatibility with older tooling.

SHA-1: also broken, avoid for security

SHA-1 produces a 160-bit hash (40 hex characters) and was the successor to MD5. It dominated TLS certificates, code signing, and version control through the 2000s. Git originally used SHA-1 to identify every commit and file object in a repository.

The SHAttered attack in 2017 demonstrated the first practical SHA-1 collision. The cost was around $110,000 in cloud computing at the time, well within reach of nation-states and large organisations. Browser vendors removed SHA-1 from TLS certificate validation shortly after. Git began transitioning to SHA-256 for new repositories. Any system still using SHA-1 for security should be treated as legacy infrastructure requiring an upgrade.

SHA-256: the current standard

SHA-256 is part of the SHA-2 family, standardised by NIST in 2001. It produces a 256-bit hash (64 hex characters). No practical attacks against SHA-256 have been demonstrated to date. It is the algorithm behind TLS certificates that secure HTTPS connections, code signing certificates for software distribution, JWT tokens using HS256 or RS256, Bitcoin's proof-of-work mechanism, and the SHA-256 checksums published by operating systems and software vendors.

SHA-256 is moderately slower than MD5 in software, but the difference is imperceptible for any file a human would work with. Hashing a 1 GB file takes fractions of a second on modern hardware regardless of which algorithm you use. Speed only becomes a meaningful factor in high-throughput systems processing millions of hash operations per second.

SHA-512: more bits, more margin

SHA-512 produces a 512-bit hash (128 hex characters) and offers a higher security margin than SHA-256. On 64-bit processors, SHA-512 can actually be faster than SHA-256 because the algorithm is built around 64-bit word operations, while SHA-256 uses 32-bit words. On 32-bit systems and most mobile chips, SHA-256 is the faster option.

SHA-512 is the right choice when you need the maximum available security margin and output size is not a constraint. It is commonly used in high-security key derivation, certain cryptographic protocols, and environments where future-proofing against advances in computing power is a priority.

Real-world examples: sha256 vs md5 in practice

Understanding which algorithm to use becomes much clearer with concrete situations. Here are four common scenarios developers and IT professionals encounter regularly.

Verifying a file download

You download a Linux distribution ISO from a mirror site. The official website lists both an MD5 checksum and a SHA-256 checksum for the file. Use the SHA-256 checksum. The purpose is to confirm the file was not tampered with on the mirror server or intercepted during download. MD5 collisions are practical, meaning a malicious mirror could serve a modified ISO that produces the same MD5 hash as the legitimate one. SHA-256 collisions are not practical, so a matching SHA-256 hash is genuine evidence the file is authentic.

JSON Web Tokens in an API

Your application issues JWTs to authenticate API requests. The JWT header specifies 'alg: HS256'. This means the token is signed using HMAC combined with SHA-256. SHA-256 is used here because the security of the signature depends on the collision resistance of the hash function: a broken hash algorithm makes signature forgery possible. RS256 (RSA with SHA-256) is also acceptable. Avoid any algorithm referencing MD5 in a JWT context.

File deduplication in a storage system

A document management system needs to detect duplicate uploads to avoid storing multiple copies. The system hashes every file on upload and compares against existing hashes. Here, MD5 is entirely appropriate. The threat model is accidental duplication, not deliberate attack. No adversary is crafting two different documents with the same MD5 hash to fool the deduplication logic. MD5 is fast and produces hashes quickly across millions of files. This is exactly the non-security use case where MD5 remains a practical tool.

Verifying a Docker image digest

Docker image registries identify every image layer by a SHA-256 digest. When you pull an image, Docker verifies the digest of each layer against what the registry reported. This gives you confidence the image you received is identical to what was pushed, with no modification in transit or on the registry. The entire container supply chain relies on SHA-256 for this integrity guarantee. If you see a digest prefixed with 'sha256:' in your docker commands, that is SHA-256 at work.

How to generate and verify a hash

AlteredIdea's Hash Generator computes MD5, SHA-1, SHA-256, SHA-512, and other algorithms directly in your browser. Paste any text or drop a file onto the tool, select the algorithm, and the hash appears instantly. Nothing is uploaded to a server: the calculation happens entirely on your device, which matters if you are hashing sensitive content like API keys, configuration files, or private documents.

To verify a file download: hash the file using SHA-256 in the tool, then compare the output character by character against the checksum published by the software vendor. A match confirms the file is identical to what the vendor distributed. Any difference, even a single character in a 64-character string, means the file has been altered.

To identify which algorithm produced an existing hash, look at its length: a 32-character hex string is MD5, 40 characters is SHA-1, 64 characters is SHA-256, and 128 characters is SHA-512. Hash output length is a reliable fingerprint for the algorithm that produced it.

Password storage: why no hash algorithm belongs here

Using SHA-256 or any other general-purpose hash function to store passwords is a security mistake, regardless of which algorithm you choose. General-purpose hash functions are designed to be fast. A modern GPU can compute billions of SHA-256 hashes per second, which means an attacker who obtains a database of SHA-256-hashed passwords can run brute-force and dictionary attacks at enormous speed.

Password storage requires purpose-built slow hash functions: bcrypt, Argon2, or scrypt. These are intentionally expensive to compute, with configurable work factors that increase as hardware gets faster. Argon2 is the current recommendation from most security standards bodies. Never store passwords as MD5, SHA-1, SHA-256, or any general-purpose hash, even with a salt appended.

Quick reference

• •File integrity checks (non-adversarial, e.g. corruption detection): MD5 is fast and sufficient
• •File integrity checks (adversarial context, e.g. download verification): SHA-256 or SHA-512 only
• •TLS certificates and code signing: SHA-256
• •JWT token signatures: SHA-256 via HS256 or RS256
• •Password storage: bcrypt, Argon2, or scrypt (not any general-purpose hash function)
• •Blockchain and Bitcoin proof-of-work: SHA-256
• •Docker image digests and container supply chain: SHA-256
• •Maximum security margin: SHA-512
• •Identifying a hash by output length: 32 chars = MD5, 40 = SHA-1, 64 = SHA-256, 128 = SHA-512

Frequently asked questions

1. 1.Is MD5 completely useless? No. MD5 is still useful for non-security tasks: file deduplication, cache keys, checksums to detect accidental corruption, and short identifiers. It is unsafe only when the threat model includes a deliberate attacker who could craft a collision.
2. 2.Can SHA-256 be cracked? No practical attack against SHA-256 has been demonstrated. It remains secure as of 2026 and is the recommended standard for security-sensitive hashing.
3. 3.What does HS256 in a JWT mean? It means the token is signed using HMAC combined with SHA-256. The H stands for HMAC, S for SHA, and 256 for the bit length. RS256 means RSA signature with SHA-256, and both are secure choices.
4. 4.Is SHA-256 too slow for production use? For human-scale file sizes the speed difference from MD5 is imperceptible. Only extremely high-throughput systems hashing millions of values per second need to weigh the performance trade-off.
5. 5.Why did Git use SHA-1 if it is broken? Git chose SHA-1 originally for speed and compact output, not security against deliberate attacks. Exploiting a SHA-1 collision in Git requires an attacker who can control both versions of a file, which is a narrow threat. The project has since begun migrating to SHA-256 for new repositories.