SHA-256 vs MD5: Which Hash Should You Actually Use?

Use SHA-256 for anything security-related, and treat MD5 as off-limits for it. MD5 is fast but broken: attackers can produce two different files with the same MD5 hash on a laptop in seconds. SHA-256 has no practical collision attack, so it is the safe default for passwords, signatures, download verification, and anything where someone might try to fool you.

That is the whole decision for most people. The rest of this guide explains why, so you can defend the choice and know the few cases where MD5 is still fine.

The short answer

If the hash protects something (a password, a certificate, a “is this the real file” check), pick SHA-256. If you only need a quick fingerprint to spot duplicate files or detect accidental corruption, and no attacker is involved, MD5 still works and runs a bit faster.

MD5 and SHA-256 are both hashing algorithms, but only SHA-256 is a safe cryptographic hash today. A cryptographic hash has to resist someone deliberately crafting collisions. MD5 fails that test. SHA-256 passes it. That single difference decides almost every real choice between md5 vs sha256.

If hashing itself is new to you, what is hashing covers the basics before you compare specific algorithms.

What MD5 and SHA-256 actually produce

MD5 outputs a 128-bit value. SHA-256 outputs a 256-bit value. Written as hexadecimal, that is 32 characters for MD5 and 64 characters for SHA-256.

Here is the same input, “hello”, through both:

MD5:     5d41402abc4b2a76b9719d911017c592
SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

Both are deterministic. The same input always gives the same digest, and changing a single byte scrambles the whole output. The difference is the size of the space. MD5 has 2^128 possible outputs; SHA-256 has 2^256. That larger space is part of why brute-forcing a SHA-256 collision is out of reach, but the bigger reason MD5 broke is a flaw in its internal structure, not just its length.

Speed vs security, the real trade-off

MD5 is faster. On the same machine it hashes data quicker than SHA-256, often by a noticeable margin on large files. For a long time that speed was the selling point.

Speed stopped mattering once the security fell apart. And for the jobs where MD5 is still acceptable (spotting duplicate files, checking that a download did not get corrupted in transit), the speed gap rarely changes anything you would feel. Modern CPUs with SHA extensions have also closed much of the distance, so “MD5 is faster” is a weaker argument than it used to be.

The real trade-off is not speed against security. It is convenience against trust. The moment someone has a reason to lie to you, MD5 gives them a door.

Why MD5 is ‘broken’, collision attacks explained

A collision is two different inputs that produce the same hash. Every hash function has collisions in theory, because you are mapping unlimited inputs onto a fixed-size output. A good cryptographic hash makes finding one collision computationally impossible in practice.

MD5 fails here. Researchers found a way to generate MD5 collisions cheaply back in 2004, and it has only gotten easier. You can now produce two files with identical MD5 hashes but different contents in seconds. This is not hypothetical: in 2012 the Flame malware used an MD5 collision to forge a Microsoft code-signing certificate and pass itself off as legitimate Windows Update code.

That is why “broken” is the right word. If an attacker can make a malicious file share the MD5 hash of a trusted one, any check based on that hash is worthless. SHA-256 has no known practical collision attack. For a deeper walk through how this works, see hash collision explained.

When MD5 is still acceptable

MD5 is not useless. It is unsafe against attackers, which is different from being unsafe against accidents. If no adversary is in the picture, these uses are fine:

• Deduplication. Grouping identical files in a backup or photo library. You are looking for accidental duplicates, not fighting someone trying to sneak a collision past you.
• Non-cryptographic checksums. A quick “did this file change” flag inside a cache or build system.
• Detecting accidental corruption. Confirming a file survived a copy without random bit-flips, where nobody is deliberately tampering.

The rule is simple. Ask whether someone benefits from faking a match. If yes, use SHA-256. If the only failure you care about is random chance or a bad cable, MD5 saves a little time and does the job. A plain checksum is exactly this kind of accident-detection tool.

Output length and what a hex digest looks like

A hash digest is usually shown as hexadecimal, where each character represents 4 bits. That is why the lengths are so tidy: 128 bits divided by 4 is 32 characters, and 256 bits divided by 4 is 64 characters.

You will sometimes see the same hash in other encodings, like Base64, which is shorter on screen because it packs 6 bits per character. The underlying value is identical; only the display changes. When you compare two hashes by eye, make sure they use the same encoding and case, since some tools print uppercase hex and others lowercase.

One practical tip: to compare two digests reliably, check the full string, not just the first and last few characters. A crafted collision or a copy-paste error can match at the ends and differ in the middle.

A quick comparison table: MD5 vs SHA-256 vs SHA-1

SHA-1 sits between the two and is worth including, because plenty of old systems still use it. It is also broken for security. Google demonstrated a real SHA-1 collision (the “SHAttered” attack) in 2017, so treat it like MD5: fine for non-security fingerprints, unsafe for anything an attacker touches.

Property	MD5	SHA-1	SHA-256
Output size	128-bit	160-bit	256-bit
Hex length	32 chars	40 chars	64 chars
Collision attack	Practical (seconds)	Practical (SHAttered, 2017)	None known
Safe for security	No	No	Yes
Good for dedup / checksums	Yes	Yes	Yes
Relative speed	Fastest	Fast	Slower, still fast

The pattern is clear. Both MD5 and SHA-1 are retired as cryptographic hash algorithms. SHA-256, part of the SHA-2 family, is the current default and will stay that way for the foreseeable future.

Generate and compare both hashes yourself

The fastest way to build intuition is to hash the same text both ways and watch the outputs. Type a word into our hash generator, then change one letter and see how completely the digest shifts. It produces SHA-256, SHA-512, SHA-1, and MD5 in one place without installing anything.

Try it with a short phrase, then paste in a longer paragraph and notice that the output length never changes. That fixed-size property is the whole point of a hash algorithm, and seeing it directly makes the theory stick.

FAQ

Is SHA-256 always better than MD5?

For security, yes. For raw speed on non-security tasks, MD5 is slightly faster, so it can still make sense for deduplication or accidental-corruption checks. But if there is any chance an attacker wants to fake a match, SHA-256 is the only safe choice.

Can SHA-256 be reversed to get the original input?

No. Hashing is one-way by design. You cannot compute the input from the digest. Attackers “crack” hashes by guessing inputs and hashing them until one matches, which is why salting and slow password-specific functions like bcrypt or Argon2 exist on top of the raw hash.

Why do people still use MD5 if it is broken?

Habit, legacy systems, and speed. A lot of MD5 usage is in non-security contexts (cache keys, file dedup) where its weakness does not matter. The danger is using it where security is assumed, like verifying a download is authentic.

What about SHA-512, is it better than SHA-256?

SHA-512 is also part of SHA-2 and is equally safe. It can be faster than SHA-256 on 64-bit hardware and produces a longer 128-character digest. For most web and file work, SHA-256 is the standard pick; SHA-512 is fine when a system specifically calls for it.