SHA-256 vs MD5 - Which Hash Should You Use? (2026)

MD5 and SHA-256 are two of the most widely used hash functions, and they turn up in the same places - file checksums, download verification, data integrity checks, and (mistakenly) password storage. But they are not interchangeable. MD5 is older and faster, yet it has been considered cryptographically broken for two decades, while SHA-256 is the modern default trusted by TLS certificates, digital signatures, and blockchains. This guide compares SHA-256 vs MD5 on length, speed, and security, explains exactly why MD5 fails, and shows where each one is still appropriate.

What is a hash function?

A cryptographic hash function takes any input - a word, a file, a gigabyte of data - and produces a fixed-length string called a hash, digest, or fingerprint. The same input always produces the same output, but the process only runs one way: you cannot take a hash and work backward to recover the original data. Both MD5 and SHA-256 are hash functions of this kind; the difference is how big their output is and how hard they are to attack.

A good cryptographic hash is expected to have three properties, and understanding them is the key to seeing why MD5 fails while SHA-256 does not.

• Deterministic and fixed-length: the same input always yields the same digest, and every digest is the same size regardless of input length.
• Preimage resistance: given a hash, it is infeasible to find any input that produces it, so you cannot reverse it.
• Collision resistance: it is infeasible to find two different inputs that produce the same hash. This is exactly the property MD5 has lost.

Hashes also show the avalanche effect: change a single character - even add a trailing space - and roughly half the output bits flip, producing a completely different digest. That is what makes hashing useful for detecting whether data has changed.

MD5: fast but broken

MD5 (Message-Digest Algorithm 5) was designed by Ron Rivest in 1991. It produces a 128-bit digest, written as 32 hexadecimal characters. For example, the MD5 of the three-letter string abc is 900150983cd24fb0d6963f7d28e17f72. MD5 is fast and was once used almost everywhere for checksums, password hashing, and digital certificates.

Why MD5 is broken

The fatal problem with MD5 is collisions. In 2004, researchers demonstrated a practical way to generate two different inputs with the same MD5 hash, and the attacks have only become faster and cheaper since. Today a collision can be produced on an ordinary computer in seconds. Because collision resistance is the property most security uses depend on, MD5 is considered cryptographically broken.

This is not just theoretical. In 2012 the Flame malware used an MD5 collision to forge a Microsoft code-signing certificate, letting it masquerade as a legitimate Windows update. Chosen-prefix collisions also make it possible to craft two files - say, a harmless document and a malicious one - that share the same MD5, so an MD5 checksum can no longer prove that a file is authentic.

SHA-256: the modern default

SHA-256 is part of the SHA-2 family, published by NIST in 2001. It produces a 256-bit digest, written as 64 hexadecimal characters. The SHA-256 of abc is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad - notice it is exactly twice as long as the MD5 digest above. SHA-256 has no known practical collision attacks and is the workhorse behind TLS/HTTPS certificates, software signing, Git object identifiers, and the Bitcoin blockchain.

It is worth mentioning SHA-1, the algorithm between MD5 and SHA-256. SHA-1 produces a 160-bit digest and was also broken by a practical collision (the 2017 SHAttered attack), so it is deprecated too. When you need a secure hash, SHA-256 is the safe, well-supported default; SHA-384 and SHA-512 offer even larger digests when you want extra margin.

SHA-256 vs MD5: side-by-side comparison

Here is how the two algorithms compare across the factors that matter most.

• Digest length - MD5 is 128 bits (32 hex characters); SHA-256 is 256 bits (64 hex characters).
• Year introduced - MD5 in 1991; SHA-256 (SHA-2 family) in 2001.
• Speed - MD5 is faster to compute; SHA-256 is slightly slower but fast enough for virtually every use.
• Collision resistance - MD5 is broken (practical collisions since 2004); SHA-256 has no known practical collisions.
• Security status - MD5 is deprecated for all security use; SHA-256 is recommended and widely trusted.
• Common uses today - MD5: legacy checksums, cache keys, non-security dedup; SHA-256: integrity verification, digital signatures, certificates, blockchains.

The takeaway: MD5 wins only on raw speed, and that speed advantage rarely matters. On every dimension that involves trust, SHA-256 wins.

When to use each

Use SHA-256 (or stronger) when

• You verify that a downloaded file matches the publisher's checksum.
• You create or check digital signatures and certificates.
• You generate content-addressed identifiers such as Git commits, deduplication keys, or caches where correctness matters.
• Any situation where someone might deliberately try to fake a matching hash.

MD5 is only acceptable when

• You need a quick check for accidental corruption on trusted, internal data.
• You are building a non-security hash-table key or cache key.
• You must interoperate with a legacy system that only understands MD5 - and no security is being claimed.

Do not use SHA-256 for passwords either

A common mistake is upgrading password storage from MD5 to SHA-256 and assuming the problem is solved. It is not. SHA-256 is designed to be fast, and speed is exactly what you do not want for passwords: it lets an attacker who steals your database try billions of guesses per second. Fast general-purpose hashes are the wrong tool for credentials.

For passwords, use a dedicated password-hashing algorithm that is deliberately slow and salted:

• Argon2 - the modern recommendation and winner of the Password Hashing Competition; memory-hard to resist GPU attacks.
• bcrypt - battle-tested and widely available, with a tunable work factor.
• scrypt - memory-hard like Argon2 and a solid alternative.

Each of these adds a unique random salt per password and lets you raise the work factor over time, which is why they - not MD5 or SHA-256 - are the correct choice for storing user credentials.

Frequently asked questions

Is MD5 secure?

No. MD5 is not secure for any purpose that relies on collision resistance, such as digital signatures, certificates, or verifying that a file has not been tampered with. Practical collision attacks have existed since 2004 and are now trivial to run. MD5 is only acceptable as a fast checksum against accidental, non-malicious corruption.

Is SHA-256 better than MD5?

Yes, for security. SHA-256 produces a longer 256-bit digest and has no known practical collision attacks, so it is the correct choice for integrity verification, signatures, and certificates. MD5's only advantage is being slightly faster, which almost never outweighs its broken security.

Can MD5 or SHA-256 be decrypted or reversed?

No. Hashing is one-way, so there is nothing to decrypt - you cannot compute the original input from a hash. What attackers do instead is guess inputs and hash them until one matches, using rainbow tables or brute force, which is why fast hashes like MD5 and unsalted SHA-256 are dangerous for passwords.

Is SHA-256 much slower than MD5?

SHA-256 is slower than MD5, but for typical workloads - hashing files, strings, or API payloads - the difference is negligible on modern hardware. The security gain far outweighs the small performance cost, so speed is rarely a good reason to choose MD5.

Should I use MD5 or SHA-256 for passwords?

Neither on its own. Both are fast general-purpose hashes, which makes offline guessing easy. Use a slow, salted password-hashing function such as Argon2, bcrypt, or scrypt instead.

What should replace MD5?

For checksums and integrity, replace MD5 with SHA-256 (or SHA-512). For password storage, replace it with Argon2, bcrypt, or scrypt. Avoid SHA-1 as a replacement, since it has also been broken by a practical collision attack.