MD5 vs SHA-256: Understanding Hash Functions
Security - 7 min read - Published 2026-08-27
A hash function takes an input of any size and produces a fixed-length output - a "digest" - that's meant to act as a unique fingerprint of that input. Change even a single character in the input, and the output changes completely and unpredictably. Hash functions are one-way: you can't reverse a digest back into the original input.
What Makes a Hash "Cryptographic"
A cryptographic hash function needs three properties to be considered secure: it should be computationally infeasible to find two different inputs that produce the same output (collision resistance), infeasible to reverse a digest back to its input (preimage resistance), and a tiny change in input should produce a dramatically different, unpredictable output (the avalanche effect).
Why MD5 Is Considered Broken
MD5 was designed in 1991 and produces a 128-bit digest. Researchers demonstrated practical collision attacks against it starting in 2004, and by 2008 those attacks were refined enough to be used against real-world systems, including forging fraudulent SSL certificates. Modern hardware can generate MD5 collisions in seconds. That doesn't mean MD5 is useless - it's still fine for non-security purposes like detecting accidental file corruption or deduplicating data - but it should never be used anywhere security depends on the result being un-forgeable, including password storage, digital signatures, or certificate verification.
Where SHA-256 Fits
SHA-256, part of the SHA-2 family published by NIST in 2001, produces a 256-bit digest and has no known practical collision attacks as of today. It's the algorithm behind Bitcoin's proof-of-work, TLS certificate signatures, and most modern software integrity checks. For anything where forgery matters - verifying a downloaded file hasn't been tampered with, checking a password against a stored hash (ideally combined with a proper key-derivation function, not used alone), or generating a digital fingerprint you'll actually rely on - SHA-256 is the reasonable default in 2026.
A Note on Password Hashing Specifically
Neither MD5 nor plain SHA-256 is actually the right tool for hashing passwords, even though people reach for them out of habit. Password hashing needs to be deliberately slow, to make brute-force guessing expensive - general-purpose hashes like SHA-256 are designed to be fast, which works against you here. Purpose-built algorithms like bcrypt, scrypt, or Argon2 add configurable computational cost specifically to resist that kind of attack.