MD5 and SHA-256 are both hashing algorithms that turn any input into a fixed-length string of characters, but they sit in very different places when it comes to trust. One is considered cryptographically broken and shouldn’t be used anywhere security matters; the other is still considered strong. This guide covers exactly what separates them and, more usefully, which one actually fits the task in front of you.
- MD5 produces a 128-bit hash and is cryptographically broken; SHA-256 produces a 256-bit hash and remains secure
- MD5 is still fine for non-security uses like detecting accidental file corruption or quick deduplication
- SHA-256 is the right choice wherever tamper resistance matters, like verifying a downloaded file's integrity against a published hash
- Neither MD5 nor raw SHA-256 should be used to store passwords, both are too fast, use bcrypt, scrypt, or Argon2 instead
- MD5's weakness is a broken algorithm design, not merely a short output length
What Actually Broke in MD5
Every hash function technically has collisions, since it maps an unlimited range of possible inputs onto a fixed-size output space. What matters is whether anyone can practically find one on purpose. MD5’s problem isn’t theoretical, researchers demonstrated practical methods to deliberately construct two different inputs that hash to the same MD5 value, in a matter of seconds on ordinary hardware.
That capability is exactly what breaks MD5 for security purposes. An attacker who can generate a malicious file with the same MD5 hash as a legitimate one can swap the two undetected by anyone checking only the hash. SHA-256, despite decades of cryptographic scrutiny, has no known practical method to do the same, which is why it remains the standard choice for anything where tamper resistance actually matters.
Where MD5 Is Still Perfectly Fine
None of this means MD5 is useless everywhere. For detecting accidental corruption, like confirming a large file transferred without a bit flipping somewhere along the way, or for quick non-security deduplication, like spotting duplicate files in a personal backup, MD5’s weakness doesn’t come into play at all. Nobody is deliberately trying to engineer a collision against your backup script, and MD5 is fast and produces a shorter, easier-to-eyeball output than SHA-256 for that kind of casual use.
The distinction to hold onto is: MD5’s problem is resistance to a deliberate adversary, not everyday accidental reliability. If nothing in your use case involves someone actively trying to fool the hash, MD5 still works exactly as intended.
Speed: A Strength for Checksums, a Weakness for Passwords
MD5’s speed is a genuine feature for checksumming a large file quickly. That same speed becomes a serious liability the moment a hash is used to protect a password.
If an attacker obtains a database of password hashes, they try to guess the original passwords by hashing enormous numbers of candidate passwords and comparing. A fast hash like MD5 or even plain SHA-256 lets modern hardware attempt billions of guesses per second, making even reasonably complex passwords crackable in a practical timeframe. Purpose-built password hashing functions like bcrypt, scrypt, and Argon2 are deliberately slow, often deliberately configurable to get slower over time as hardware improves, and include salting by design, which is what actually makes stored passwords resistant to this kind of attack. Using SHA-256 alone for password storage is a common and genuinely dangerous mistake, not because SHA-256 is broken, but because speed itself is the wrong property here.
Quick Comparison
| MD5 | SHA-256 | |
|---|---|---|
| Output length | 128 bits | 256 bits |
| Collision resistance | Broken, practical attacks exist | No known practical attack |
| Speed | Fast | Slower, more computational rounds |
| Good for | Checksums, accidental-corruption detection, non-security deduplication | File integrity verification, digital signatures, general cryptographic use |
| Bad for | Anything requiring tamper resistance | Password storage on its own, without a purpose-built algorithm |
Generating Either Hash
Computing an MD5 or SHA-256 hash by hand isn’t practical, both rely on well-defined but intricate bit manipulation that’s meant to be run by an algorithm, not worked out manually. The Hash Generator computes both MD5 and SHA-family hashes from pasted text or an uploaded file entirely in the browser, useful for verifying a download against a publisher’s published checksum or generating one for your own files.
The short version
MD5 and SHA-256 are both hash functions, but only one is currently considered secure against a deliberate adversary. MD5’s practical collision attacks make it unsuitable anywhere tamper resistance matters, though it remains fine for casual, non-adversarial uses like corruption detection. SHA-256 is the right default for file integrity and general cryptographic use, but neither algorithm, used alone, belongs in password storage, that job calls for a purpose-built, deliberately slow algorithm like bcrypt or Argon2 instead.
