MD5 vs SHA-1 vs SHA-256: What's the Difference?

What all three have in common

Each is a one-way function: computing the hash of an input is fast, but reversing a hash back to its input is computationally infeasible. Each is deterministic — the same input always yields the same hash, which is what makes hashes useful as fingerprints. And each produces a fixed-size output regardless of input size: MD5 gives 128 bits (32 hex characters), SHA-1 gives 160 bits (40 hex), SHA-256 gives 256 bits (64 hex).

The security of a hash rests on collision resistance: it should be practically impossible to find two different inputs that produce the same hash. This is the property that separates the three.

MD5: fast, ubiquitous, broken

MD5 dates from 1992 and was the internet's default fingerprint for years. Its collision resistance collapsed in 2004, when researchers demonstrated two different inputs with the same MD5 hash; today, crafting MD5 collisions takes seconds on a laptop. The attack is not theoretical — the Flame malware in 2012 used an MD5 collision to forge a Microsoft code-signing certificate.

What this means practically: an attacker can construct two files with identical MD5 hashes — one benign, one malicious — so MD5 must never be used for anything security-related: not signatures, not certificates, not password storage, not verifying downloads from untrusted sources. What it does not mean: MD5 is still perfectly serviceable as a fast checksum against accidental corruption — detecting a failed download or a bit-flipped backup — where no adversary is involved.

SHA-1: the same story, a decade later

SHA-1 (1995) was MD5's stronger sibling and inherited its role — and eventually its fate. Google and CWI demonstrated the first practical SHA-1 collision in 2017 (the "SHAttered" attack, two different PDFs with the same hash), and by 2020 collisions were cheap enough for well-resourced attackers. Browsers stopped accepting SHA-1 TLS certificates back in 2017.

You'll still encounter SHA-1 in older systems — notably Git, which historically identified commits by SHA-1 (hardened against known attacks, and migrating to SHA-256). Treat it like MD5: acceptable as a legacy checksum, unacceptable for anything an attacker might target.

SHA-256: today's default

SHA-256 belongs to the SHA-2 family (2001) and has no known practical attacks — no collisions, no meaningful weakening after two decades of cryptanalysis. It is the standard for TLS certificates, code signing, software release verification, blockchain (Bitcoin's entire proof-of-work is SHA-256), and government use as a NIST standard.

The rule of thumb is simple: when in doubt, use SHA-256. Its longer output and slower speed versus MD5 are irrelevant for almost every real workload — hashing even large files takes moments on modern hardware.

One important caveat: no fast hash — including SHA-256 — is appropriate for storing passwords. Fast hashes are exactly what attackers want, because they can guess billions of candidates per second. Passwords need deliberately slow, salted algorithms like bcrypt, scrypt or Argon2.

Checking a hash yourself

The everyday use case: a website publishes the SHA-256 of a file it distributes, and you verify your download matches before trusting it. Tools-Bench's hash generator computes MD5, SHA-1 and SHA-256 for text or files directly in your browser — the file is read locally on your device, never uploaded, so you can safely fingerprint even confidential documents.

Frequently asked questions

Try it yourself