MD5 vs SHA-1 vs SHA-256: which hash should you use?

Pick a hash function and you're spoiled for choice: MD5, SHA-1, SHA-256, SHA-512, and a dozen more. The names suggest a simple "bigger number is better" ladder. The reality is more interesting, and getting it wrong can quietly undermine your security.

Here's the short version of what each is actually for in 2026.

What a hash actually is

A cryptographic hash takes any input — a word, a file, a gigabyte of video — and produces a fixed-length fingerprint. Feed it hello and SHA-256 always returns the same 64-character string; change a single letter and the output looks completely different. It's one-way by design: you can't run it backwards to recover the input. That's what makes hashes useful for checking integrity and representing passwords.

The three you'll meet most

MD5 produces a 128-bit digest, is fast, and is thoroughly broken for security. Researchers can generate collisions — two different inputs with the same hash — on ordinary hardware. That doesn't make it useless: as a non-security checksum to catch accidental file corruption, it's still fine and common. Just never rely on it where an attacker is in the picture.

SHA-1 (160-bit) is the awkward middle child. It held on for years, but a practical collision was demonstrated back in 2017, and the industry has moved off it. Git famously used it for object IDs, and even Git has been migrating away. Treat SHA-1 as deprecated for anything that matters.

SHA-256 (part of the SHA-2 family, 256-bit) is the current sensible default. No practical collisions, supported everywhere, and fast enough for almost everything. When someone says "just hash it," this is usually the right answer. Its sibling SHA-512 isn't more secure in practice — it can simply be faster on 64-bit hardware — and is fine to use too.

The password exception

Here's the trap. For passwords you do not want a fast hash, and SHA-256 is fast. Speed helps an attacker churning through billions of guesses against a stolen database. Passwords should go through a deliberately slow, salted algorithm built for the job — bcrypt, scrypt or Argon2 — not a bare SHA-256. "Hashed" and "hashed correctly" are not the same thing here.

So, which one?

Verifying a download or fingerprinting content: SHA-256. A quick non-security checksum: MD5 is fine if it's already in use. Storing passwords: a purpose-built password hash, never a raw SHA. And anything still riding on SHA-1 is worth a ticket to move.

If you want to see the difference, our hash generator shows MD5, SHA-1, SHA-256 and SHA-512 side by side for the same input, all computed in your browser. There are focused pages too — SHA-256 for the everyday default and MD5 for checksums — plus the rest on the hashing & security tools page.