You've seen MD5, SHA-1, and SHA-256 in checksum tools, package managers, and database tables — but which one should you actually use in 2026? This guide explains what hashing is, why MD5 and SHA-1 are cryptographically broken, and when each algorithm is (or isn't) safe.
The one-line rule
For any security-sensitive use — passwords, integrity checks against tampering, API signatures — use SHA-256 (or stronger), never MD5 or SHA-1. MD5 and SHA-1 remain only in legacy compatibility and non-security contexts (e.g., accidental-duplicate detection).
1. What a hash actually is
A hash function maps any input — a file, a password, a message — to a fixed-size digest:
MD5("hello world") = 5eb63bbbe01eeed093cb22bb8f5acdc3
SHA-1("hello world") = 2aae6c35c94fcfb415dbe95f408b9ce91ee846ed
SHA-256("hello world") = b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
Three defining properties make hashes useful:
- Deterministic — same input always gives the same output.
- One-way — you can't recover the input from the digest (no practical inverse).
- Avalanche effect — changing one bit of input flips roughly half the output bits, so similar inputs look completely different.
2. The comparison table
| Algorithm | Digest size | Broken? | Status in 2026 | Good for |
|---|---|---|---|---|
| MD5 | 128-bit (32 hex) | Yes — collisions since 2004 | Never for security | Caching keys, dedupe |
| SHA-1 | 160-bit (40 hex) | Yes — SHAttered 2017 | Deprecated everywhere | Legacy git objects |
| SHA-256 | 256-bit (64 hex) | No known practical attack | Industry default | Signatures, integrity, TLS |
| SHA-512 | 512-bit (128 hex) | No known practical attack | Stronger sibling | High-security contexts |
3. Why MD5 and SHA-1 are broken
Collision = two different inputs producing the same digest. In 2004, researchers demonstrated MD5 collisions; by 2008 they were producing them in seconds on consumer hardware. SHA-1's first real collision ("SHAttered", 2017) took Google roughly 6,500 CPU-years — still feasible for a well-resourced attacker, and the method has only gotten cheaper since.
Why this matters: if an attacker can craft a file that hashes identically to a legitimate one, they can swap malicious content into a system that trusts hash-based fingerprints — think package downloads, certificates, or code signing. There's also the birthday paradox: collisions for an n-bit hash become practical at roughly 2^(n/2) operations — for MD5 that's ~2^64 (fast), for SHA-256 ~2^128 (world was not built for that).
4. Password hashing — a separate topic
Even SHA-256 is the wrong tool for passwords. Password hashes need to be slow to resist brute force, which is why the industry uses bcrypt, scrypt, or Argon2 (and salts everything). Plain SHA-256 for passwords is vulnerable to fast dictionary attacks — use a password-stretching KDF instead. MD5-for-passwords is worst of all: roughly 10^10 hashes per second are trivial on GPUs.
5. What SHA-256 is used for today
- File integrity — download checksums (most Linux ISOs publish SHA-256).
- TLS certificates & signatures — SHA-256 is the default in the Web PKI.
- API integrity — HMAC-SHA256 message authentication.
- Content addressing — dedup systems and some blob stores.
- Merkle trees — blockchains, git commit integrity.
Compute MD5, SHA-1, SHA-256, SHA-512 and HMAC for any text instantly — in your browser.
Open Hash Generator6. Frequently asked questions
Is MD5 still used? Yes, but only where integrity-adversary isn't a concern: checksums for accidental corruption, caching keys, deduplication. Never for security. Is SHA-256 quantum-safe? Grover's algorithm halves effective strength to 2^128 — still safe in practice for decades. Can I reverse a hash? No, but short inputs (passwords, names) can be found via precomputed rainbow tables — which is why salt exists. Which should I pick for checksums? SHA-256: universally supported and practical.