You've seen MD5, SHA-1, and SHA-256 in checksum tools, package managers, and database tables — but which one should you actually use in 2026? This guide explains what hashing is, why MD5 and SHA-1 are cryptographically broken, and when each algorithm is (or isn't) safe.
The one-line rule
Use SHA-256 rather than MD5 or SHA-1 for new checksums that require collision resistance. For passwords, use a password-hashing scheme such as Argon2id, not plain SHA-256. A checksum only detects malicious replacement if the expected digest comes from a trusted source. Authenticate API messages with an appropriate MAC, such as HMAC-SHA256, or a digital signature; an unkeyed hash alone does not authenticate a sender.
1. What a hash actually is
A hash function maps any input — a file, a password, a message — to a fixed-size digest:
MD5("hello world") = 5eb63bbbe01eeed093cb22bb8f5acdc3
SHA-1("hello world") = 2aae6c35c94fcfb415dbe95f408b9ce91ee846ed
SHA-256("hello world") = b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
Three defining properties make hashes useful:
- Deterministic — same input always gives the same output.
- One-way — you can't recover the input from the digest (no practical inverse).
- Avalanche effect — changing one bit of input flips roughly half the output bits, so similar inputs look completely different.
2. The comparison table
| Algorithm | Digest size | Broken? | Status in 2026 | Good for |
|---|---|---|---|---|
| MD5 | 128-bit (32 hex) | Yes — collisions since 2004 | Never for security | Caching keys, dedupe |
| SHA-1 | 160-bit (40 hex) | Yes — SHAttered 2017 | Avoid for new collision-resistant designs | Legacy git objects |
| SHA-256 | 256-bit (64 hex) | No known practical attack | Industry default | Signatures, integrity, TLS |
| SHA-512 | 512-bit (128 hex) | No known practical attack | Stronger sibling | High-security contexts |
3. Why MD5 and SHA-1 are broken
Collision means two different inputs producing the same digest. Practical MD5 collision attacks have been known since 2004; the SHAttered project demonstrated a SHA-1 collision in 2017. These algorithms are unsuitable where an attacker could exploit collisions.
A collision attack finds a pair of inputs, not necessarily a replacement for any arbitrary existing file. That distinction matters: constructing collisions and finding a second preimage for a specified input are different problems. For an ideal n-bit hash, a generic birthday collision search takes on the order of 2^(n/2) evaluations: about 2^64 for a 128-bit hash and 2^128 for a 256-bit hash. MD5's weaknesses allow attacks substantially cheaper than that ideal bound.
4. Password hashing — a separate topic
Plain SHA-256 is the wrong tool for password storage. Use a dedicated password-hashing scheme with a unique salt and appropriate work factors. OWASP recommends Argon2id, with scrypt as an alternative and bcrypt for legacy systems. Fast general-purpose hashes make offline password guessing too cheap; adding a salt alone does not make them slow.
5. What SHA-256 is used for today
- File integrity — download checksums (most Linux ISOs publish SHA-256).
- TLS certificates & signatures — SHA-256 is the default in the Web PKI.
- API integrity — HMAC-SHA256 message authentication.
- Content addressing — dedup systems and some blob stores.
- Merkle trees — blockchains, git commit integrity.
Compute MD5, SHA-1, SHA-256, SHA-512 and HMAC for any text instantly — in your browser.
Open Hash Generator6. Frequently asked questions
Is MD5 still used? Yes, in legacy compatibility and non-adversarial checksums or caching. Prefer SHA-256 for new designs, and do not rely on MD5 collision resistance.
Is SHA-256 quantum-safe? Idealized Grover search reduces generic preimage query complexity from about 2^256 to 2^128; that is not a forecast of practical hardware capability, nor the same as collision resistance.
Can I reverse a hash? There is no general practical inverse for a secure cryptographic hash, but an attacker can guess likely inputs and compare their digests. A salt prevents reuse of precomputed tables across password records; an appropriately costly password-hashing scheme also slows each guess.
Which should I pick for checksums? SHA-256 is widely supported. If you need protection against tampering, obtain the expected checksum through a trusted channel or verify a digital signature.