Comparison

SHA-256 vs MD5

MD5 produces a 128-bit digest and SHA-256 a 256-bit one, but the real difference is that MD5 is broken. Collisions — two different inputs with the same digest — can be produced on a laptop in seconds, so MD5 cannot prove a file is unaltered. Use SHA-256 for anything security-related. MD5 remains acceptable only as a non-security checksum.

SHA-256 Hash Generator

Generate a SHA-256 digest — the modern default.

Open the tool

"Broken" has a precise meaning here, and it is worth being exact. MD5 is broken for collision resistance: an attacker can construct two different inputs that hash to the same value. It is not broken for preimage resistance — given a digest, recovering an input that produces it is still computationally infeasible.

That distinction explains why MD5 has not vanished. It is fatal wherever an attacker chooses the input, such as file signing or certificate issuance. It is largely irrelevant where you are only guarding against accidental corruption.

What collision resistance protects

If an attacker can find two files with the same digest, they can have a benign version signed or approved and then substitute the malicious one, since the checksum still matches. This is not theoretical: it has been used to forge certificates and to produce colliding executables and documents.

Practical differences

Digest length: MD5 is 128 bits, 32 hex characters; SHA-256 is 256 bits, 64 hex characters.
Collision resistance: MD5 broken since 2004; SHA-256 has no practical attack.
Speed: MD5 is faster, which is a disadvantage for anything password-related.
Status: MD5 is prohibited for security use by essentially every current standard.

Where MD5 is still acceptable

Where no attacker is choosing the input and you are only detecting accidental change: verifying a file copied across a flaky network, deduplicating your own files, or generating a cache key. Even then SHA-256 costs little more, so the main reason to keep MD5 is compatibility with a system you cannot change.

Neither belongs in password storage

This is the more common mistake. Both MD5 and SHA-256 are far too fast for storing passwords — a GPU computes billions per second, so a stolen database falls quickly. Password storage needs a deliberately slow, salted function: bcrypt, scrypt or Argon2.

Frequently asked questions

Is MD5 completely useless now?

No, but its safe uses are narrow. It is broken for collision resistance, so it cannot prove a file has not been tampered with by someone who chose its contents. It still detects accidental corruption perfectly well.

Can MD5 be reversed?

Not directly — preimage resistance still holds. But short or common inputs are trivially recovered from precomputed rainbow tables, which is why hashing a password with bare MD5 offers almost no protection.

Is SHA-1 any better?

Only marginally, and not enough to matter. A practical collision was demonstrated in 2017. SHA-1 is deprecated for security use everywhere and should be treated the same as MD5: compatibility only.

Why is MD5 still everywhere?

Inertia and speed. It is embedded in older protocols, file formats and internal systems that were built before the attacks were practical and have not been migrated. Its continued presence reflects migration cost, not security judgement.

Which should I use to verify a download?

SHA-256, whenever the publisher provides it. If only an MD5 checksum is offered, it will still catch a corrupted download, but it cannot prove the file was not deliberately replaced.

Tools used in this guide

All tools →

All guides →

Last reviewed 7 August 2026.