MD5 vs SHA256 vs SHA-1: which hash should you use?

MD5 vs SHA256: the short answer

Use SHA-256 (often written SHA256). It produces a longer fingerprint, has no known practical attacks, and on modern processors it's often faster than MD5. Use MD5 or SHA-1 only when a system you can't change requires them, or when you just need to detect accidental corruption and nobody has a reason to fake a match.

For passwords, the answer is none of them. Fast hashes let an attacker test billions of guesses; password storage needs a deliberately slow algorithm, covered below.

What is a hash?

A hash function turns input of any size into a fixed-length fingerprint called a digest. The same input always gives the same digest, and changing a single character gives a completely different one:

Input   MD5                               SHA-256
hello   5d41402abc4b2a76b9719d911017c592  2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
Hello   8b1a9953c4611296a827abf8c47804d7  185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969

A cryptographic hash also needs to be one-way (you can't work back from the digest to the input) and collision resistant (nobody can find two different inputs with the same digest). Collisions must exist, since infinitely many inputs map to a fixed number of outputs, but for a secure hash finding one should take an impractical amount of computing. When researchers find a shortcut, the hash is considered broken for security uses.

Hashing isn't encryption. There's no key and no way to decrypt a digest; if you need to get the original back later, encrypt it instead, for example with our AES text encryption tool. Sites that claim to decrypt MD5 hashes are looking the digest up in huge tables of precomputed hashes of common words and passwords. It also isn't encoding: Base64 can be reversed by anyone with a Base64 decoder, as our Base64 explainer shows, while a hash can't be reversed at all.

MD5 vs SHA-1 vs SHA-256 compared

We measured speed with OpenSSL 3.0 on one core of a 2.1 GHz Intel Xeon cloud server, hashing 16 KB blocks. This CPU has the SHA extensions found in many recent Intel and AMD processors, which speed up SHA-1 and SHA-256 but not MD5.

The speed result surprises people who learned that MD5 is the fast one. On older processors without SHA instructions MD5 usually does win, but the gap doesn't justify using it. You can tell the algorithms apart by length alone: 32, 40 or 64 hex characters.

Is MD5 secure?

Not for anything an attacker might target. In August 2004, Xiaoyun Wang, Dengguo Feng, Xuejia Lai and Hongbo Yu published collisions for MD5 and several related hashes (Cryptology ePrint 2004/199). Attacks then got cheaper and more flexible. The most damaging is the chosen-prefix collision, where an attacker starts from two different meaningful files and appends data until their digests match.

That attack was used in the wild. The Flame espionage malware, found in 2012, carried a forged Microsoft code-signing certificate. Cryptanalyst Marc Stevens at CWI showed it was made with a previously unknown variant of an MD5 chosen-prefix collision attack against a Microsoft certificate authority that still accepted MD5 signatures. RFC 6151 (2011) had already stated that MD5 is no longer acceptable where collision resistance is required, such as digital signatures.

What MD5 still does well is catch accidents. A flipped bit from a bad download or a failing disk changes the digest, and random damage won't produce a collision. If a project only publishes an MD5 checksum, checking it is better than not checking, but it can't prove the file came from the publisher.

SHA-1 vs SHA-256: SHAttered and after

SHA-1 lasted longer. On 23 February 2017, researchers from CWI Amsterdam and Google announced SHAttered: two different PDF files with the same SHA-1 digest. It took about nine quintillion SHA-1 computations, roughly 6,500 CPU-years and 110 GPU-years, which Google said was about 100,000 times faster than a brute-force attack.

In 2020, Gaëtan Leurent and Thomas Peyrin published "SHA-1 is a Shambles", the first chosen-prefix collision for SHA-1, and estimated its cost at about US$45,000 of rented GPU time (US$11,000 for a plain collision). They used it to show forged PGP key certifications. In December 2022 NIST announced that SHA-1 should be phased out by 31 December 2030 in favour of SHA-2 and SHA-3.

SHA-256 belongs to the SHA-2 family, alongside SHA-224, SHA-384 and SHA-512. No practical collision or preimage attack on it is known. One caveat for developers: SHA-256 on its own allows length-extension attacks, so to authenticate a message with a secret key, use HMAC-SHA256 instead of hashing the secret and message together.

Hashes and passwords: use Argon2, scrypt or bcrypt

Speed is good for checksums and bad for passwords. In our test one CPU core computed about 5 million SHA-256 hashes per second of short inputs; an attacker with stolen hashes and GPUs can try far more. The OWASP Password Storage Cheat Sheet states that fast algorithms such as SHA-256 are not suitable for password storage, and recommends, in order:

• Argon2id with at least 19 MiB of memory, 2 iterations and 1 degree of parallelism.
• scrypt with a CPU/memory cost of at least 2^17, block size 8 and parallelism 1, if Argon2id isn't available.
• bcrypt for legacy systems, with a work factor of 10 or more. Most implementations only read the first 72 bytes of a password.
• PBKDF2-HMAC-SHA256 with 600,000 iterations when FIPS-140 compliance is required.

All of these add a unique random salt per password, so identical passwords produce different hashes and precomputed tables don't work. Use your framework's built-in password hashing rather than writing your own. For generating the passwords themselves, our password generator runs in the browser.

How to verify a file checksum on Windows, Mac and Linux

Download the file and its published checksum from the official site, compute the hash locally, and compare. Hex digests aren't case-sensitive, so 2CF24D... and 2cf24d... are the same value. If they differ by even one character, download again.

Windows

Both tools are built in. certutil works in Command Prompt; in PowerShell, Get-FileHash uses SHA256 unless you pass -Algorithm:

REM Command Prompt
certutil -hashfile C:\Users\you\Downloads\installer.iso SHA256

# PowerShell (SHA256 is the default)
Get-FileHash .\installer.iso
Get-FileHash .\installer.iso -Algorithm MD5

# PowerShell: compare with the published value (-eq ignores case)
(Get-FileHash .\installer.iso).Hash -eq "2CF24DBA5FB0A30E26E83B2AC5B9E29E1B161E5C1FA7425E73043362938B9824"

Mac

macOS includes shasum for the SHA family and md5 for MD5:

shasum -a 256 ~/Downloads/installer.dmg
shasum -a 1 ~/Downloads/installer.dmg
md5 ~/Downloads/installer.dmg

# Check against a published value (two spaces before the file name)
echo "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824  installer.dmg" | shasum -a 256 -c

Linux

GNU coreutils has one command per algorithm. The -c option reads a checksum file, such as the SHA256SUMS many Linux distributions publish, and prints OK or FAILED for each file:

sha256sum installer.iso
md5sum installer.iso
sha1sum installer.iso

# Check every file listed in a checksum file you downloaded
sha256sum -c SHA256SUMS --ignore-missing

In the browser

Our hash generator computes MD5, SHA-1 and SHA-256 of text or any file at once, and its compare box tells you whether a pasted checksum matches. The file is read locally and isn't uploaded.

Frequently asked questions

Sources

• Wang, Feng, Lai and Yu: Collisions for Hash Functions MD4, MD5, HAVAL-128 and RIPEMD (Cryptology ePrint 2004/199)
• SHAttered: the first SHA-1 collision (CWI Amsterdam and Google)
• USENIX Security 2020: SHA-1 is a Shambles (Leurent and Peyrin)
• NIST: NIST Retires SHA-1 Cryptographic Algorithm
• OWASP: Password Storage Cheat Sheet
• Microsoft Learn: Get-FileHash

Published 11 October 2026Written and fact-checked by the ToolzyLab teamEditorial policy