SHA-256 vs SHA-1 vs MD5 (and SHA-512, SHA-3, BLAKE3): Which Hash Algorithm to Use

The algorithms at a glance

algorithm   output     hex length   status                       typical use today
MD5         128 bits   32           broken (collisions, 2004)    non-security checksums, cache keys
SHA-1       160 bits   40           broken (collisions, 2017)    legacy: old Git repos, old signatures
SHA-256     256 bits   64           secure (SHA-2 family)        default for integrity and signatures
SHA-512     512 bits   128          secure (SHA-2 family)        same, often faster on 64-bit CPUs
SHA3-256    256 bits   64           secure (FIPS 202, 2015)      alternative design to SHA-2
BLAKE3      256 bits   64           secure, not NIST-standard    very fast file hashing

MD5("abc")     = 900150983cd24fb0d6963f7d28e17f72
SHA-1("abc")   = a9993e364706816aba3e25717850c26c9cd0d89d
SHA-256("abc") = ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

The hex length tells you which algorithm produced a hash: 32 characters is almost always MD5, 40 is SHA-1, 64 is SHA-256 or SHA3-256, and 128 is SHA-512.

What "broken" means for MD5 and SHA-1

A cryptographic hash should resist three attacks: finding an input for a given hash (preimage), finding a second input with the same hash as a given one (second preimage), and finding any two inputs with the same hash (collision). MD5 and SHA-1 fail the third.

MD5 collisions were demonstrated in 2004 and can now be produced in seconds. They were used to forge a certificate authority certificate in 2008 and to sign the Flame malware in 2012. SHA-1 fell in 2017, when Google and CWI Amsterdam published two different PDF files with the same SHA-1 ("SHAttered"). A 2020 chosen-prefix attack ("SHA-1 is a Shambles") made practical forgeries cheaper still. NIST has announced that SHA-1 should be phased out completely by 31 December 2030.

Neither is broken for preimages. Nobody can reverse an MD5 hash of a long random value. But collisions are enough to break digital signatures, certificates and any system that trusts two documents with the same hash to be the same document.

SHA-256 vs SHA-512 vs SHA-3

SHA-256 and SHA-512 belong to the SHA-2 family defined in FIPS 180-4, and both are secure. SHA-256 is the default almost everywhere: TLS certificates, code signing, Bitcoin, Subresource Integrity, JWT HS256/RS256. SHA-512 is often faster than SHA-256 on 64-bit processors without dedicated SHA instructions, because it works on 64-bit words; CPUs with SHA extensions accelerate SHA-256 instead. Benchmark on your own hardware if speed matters (openssl speed sha256 sha512).

SHA-3, standardised in FIPS 202 in 2015, uses a completely different internal design (Keccak). It is a hedge in case a weakness is ever found in SHA-2, not a replacement for it. BLAKE2 and BLAKE3 are fast, secure hashes popular in software, such as BLAKE2 in libsodium and Argon2. They are not NIST standards, which matters in regulated environments.

Length extension: a trap in MD5, SHA-1 and SHA-2

MD5, SHA-1, SHA-256 and SHA-512 share a construction that allows a length-extension attack. If a system authenticates messages as hash(secret + message), an attacker who sees one valid hash can compute a valid hash for message + padding + extra without knowing the secret. Flickr's API had a signature vulnerability of exactly this kind, published by Thai Duong and Juliano Rizzo in 2009.

The fix is not a different hash but a proper construction: HMAC, as in HMAC-SHA256, is immune, and so are SHA-3, BLAKE2/3 and the truncated variants SHA-512/256 and SHA-384.

# Wrong: vulnerable to length extension
sig = sha256(secret + message)

# Right
import hmac, hashlib
sig = hmac.new(secret, message, hashlib.sha256).hexdigest()

Common hashing mistakes

Hashing passwords with any of these algorithms. The speed that makes SHA-256 good for checksums lets an attacker run guesses against a leaked table on a GPU, and a salt does not change that. Argon2id, scrypt and bcrypt are slow and tunable on purpose, which is why OWASP recommends them.

Calling a hash "encryption". Hashes cannot be decrypted, and data that must be read back needs encryption with a key. MD5 "decrypt" sites only look up known inputs.

Comparing hashes with ==. When comparing a secret-derived value, such as a signature or token hash, a normal string comparison can leak timing information. Use hmac.compare_digest, crypto.timingSafeEqual or hash_equals.

Hashing text without fixing the bytes. A trailing newline, CRLF line endings or a different text encoding produce a completely different hash for text that looks identical. Hash explicit UTF-8 bytes.

Using a checksum from the same server as the download. It detects corruption but not tampering: an attacker who replaces the file replaces the checksum too. Verify signatures, such as GPG or Sigstore, for that.

Which one to use

For file integrity, deduplication and content addressing, use SHA-256, or BLAKE3 when speed matters and standards compliance does not. For signatures and certificates, use SHA-256 or stronger, never MD5 or SHA-1. For message authentication with a shared secret, use HMAC-SHA256. For passwords, use Argon2id or bcrypt, never a plain hash. For non-security checksums such as cache keys, MD5 is still acceptable, though SHA-256 costs little more.

Sources and further reading

FIPS 180-4 defines SHA-1 and SHA-2, and FIPS 202 defines SHA-3. RFC 6151 and RFC 6194 describe the security of MD5 and SHA-1. The SHAttered (2017) and "SHA-1 is a Shambles" (2020) papers describe the SHA-1 collisions, and NIST's December 2022 announcement sets the 2030 retirement of SHA-1. RFC 2104 defines HMAC, and the OWASP Password Storage Cheat Sheet covers password hashing.

Frequently asked questions

What is the difference between MD5, SHA-1 and SHA-256?

Output size and security. MD5 produces 128 bits and SHA-1 160 bits, and both are broken for collisions. SHA-256 produces 256 bits, is part of SHA-2, and is the secure default today.

Is SHA-1 still safe to use?

Not where an attacker could benefit from a collision, such as signatures, certificates or deduplication of untrusted data. Practical SHA-1 collisions exist since 2017, and NIST plans to retire it by 2030.

Is SHA-256 better than SHA-512?

Both are secure. SHA-256 is more widely used and hardware-accelerated on many CPUs; SHA-512 can be faster on 64-bit machines without SHA extensions and has a longer output. Choose by compatibility first.

Which hash algorithm should I use for passwords?

None of these. Use Argon2id, scrypt or bcrypt, which are designed to be slow and resist GPU attacks. Fast hashes like SHA-256 are unsuitable even with a salt.

How can I tell which algorithm produced a hash?

By its length in hex: 32 characters usually means MD5, 40 means SHA-1, 64 means SHA-256 or SHA3-256, and 128 means SHA-512.

What is a hash collision?

Two different inputs that produce the same hash. They exist for every hash function, but for a secure one nobody can find them. For MD5 and SHA-1 they can now be computed deliberately.