SHA-256 vs MD5: Which Hash Algorithm Should You Use?

If you've ever stored a password, verified a file download, or signed an API request, you've relied on a hash function. MD5 and SHA-256 are two of the most widely known, but they are not interchangeable. One is cryptographically broken. The other is a workhorse of modern security infrastructure. This article explains both clearly, so you can make the right call in your own projects.

What Is Hashing?

A hash function takes an input of any length and returns a fixed-length output called a digest or hash. The same input always produces the same output, but even a single character change in the input produces a completely different hash — this property is called the avalanche effect.

Critically, hashing is a one-way operation. You cannot reverse a hash back into the original input (without brute-forcing it). This is what makes hashes useful for storing passwords: the server never needs to know your actual password, only its hash.

MD5: Fast, Convenient, and Broken

MD5 (Message Digest 5) was designed by Ron Rivest in 1991. It produces a 128-bit (32 hex character) digest. For years it was the default choice for everything from checksums to password storage.

# MD5 example
echo -n "hello" | md5sum
# 5d41402abc4b2a76b9719d911017c592

Here's the problem: MD5 is cryptographically broken. Researchers demonstrated collision attacks — where two different inputs produce the same hash — as far back as 2004. By 2008, forged SSL certificates were created using MD5 collisions. In 2012, the Flame malware used an MD5 collision to fake a legitimate Microsoft code-signing certificate.

Why MD5 Fails for Security

• Collisions are feasible: An attacker can craft two different files with the same MD5 hash in seconds on modern hardware.
• Too fast: MD5 was designed for speed. GPUs can calculate billions of MD5 hashes per second, making brute-force attacks against stored passwords practical.
• Rainbow tables: Precomputed tables of MD5 hashes for common passwords are freely available online.

SHA-256: The Modern Standard

SHA-256 is part of the SHA-2 family (Secure Hash Algorithm 2), published by NIST in 2001. It produces a 256-bit (64 hex character) digest.

# SHA-256 example
echo -n "hello" | sha256sum
# 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

As of 2026, no practical collision attacks against SHA-256 have been demonstrated. The algorithm remains the backbone of TLS certificates, Bitcoin's proof-of-work, code signing, and most modern security protocols.

SHA-256 vs SHA-512

SHA-512 uses a 512-bit digest and is slightly faster on 64-bit processors due to how it uses 64-bit words internally. For most purposes, SHA-256 is more than sufficient. Use SHA-512 if you need the extra margin for very long-term archival security or if your platform benchmarks faster with it.

Side-by-Side Comparison

Property	MD5	SHA-256
Output size	128-bit (32 hex chars)	256-bit (64 hex chars)
Speed	Very fast	Fast
Collision resistance	Broken	Strong (as of 2026)
Suitable for passwords?	No	No (use bcrypt/Argon2)
Suitable for checksums?	Marginally (use SHA-256)	Yes
Used in TLS?	Deprecated	Yes
Used in Bitcoin?	No	Yes (double SHA-256)

Important Nuance: Neither MD5 Nor SHA-256 Is Suitable for Passwords

This is the single most important thing to take away from this article. Never use a raw hash function to store passwords — not MD5, not SHA-256, not even SHA-512. They're all too fast.

Password hashing requires deliberately slow algorithms that are resistant to GPU-based brute-force attacks. Use these instead:

• bcrypt — the historical gold standard, widely supported, configurable cost factor
• Argon2id — the winner of the Password Hashing Competition (2015), recommended for new projects in 2026
• scrypt — memory-hard, good choice when Argon2 isn't available

// PHP — correct password hashing
$hash = password_hash($password, PASSWORD_ARGON2ID);

// Verify
if (password_verify($password, $hash)) {
    // Login successful
}

When MD5 Is Still Acceptable

MD5 isn't useless — it's just useless for security. It remains fine for:

• Non-security checksums where collision attacks are irrelevant (e.g., detecting accidental file corruption on a trusted network)
• Cache keys and deduplication identifiers in non-adversarial contexts
• Legacy system compatibility where you have no choice

Even in these cases, SHA-256 is a better habit to build. It's fast enough for checksums and you won't accidentally use it in a security context later.

Practical Use Cases for SHA-256

• File integrity verification: Download a file, hash it, compare against the published SHA-256 checksum
• Digital signatures: Hash the message with SHA-256, then sign the hash with your private key
• HMAC authentication: HMAC-SHA256 is the standard for API request signing
• Commit IDs in Git: Git switched from SHA-1 to SHA-256 in Git 2.29
• TLS certificates: SHA-256 is the standard signature hash for X.509 certificates