Three famous hash functions, three different eras of cryptographic confidence. This comparison covers output sizes, what "broken" actually means for each one, and the jobs each can still legitimately do — including the one job none of them should ever do.
Ask a room of developers about MD5 and someone will say "it's broken, never use it" — which is true for some purposes, false for others, and useless as guidance until you know which. Hash functions fail in specific ways: a function can be broken for collisions (finding two inputs with the same output) while remaining perfectly serviceable as a checksum against accidental corruption. The honest comparison has to separate the attack from the application.
Below: the vital statistics of MD5, SHA-1 and the SHA-2 family, what researchers have actually demonstrated against each, and a decision guide that respects both the cryptography and the real world.
Key takeaways
- MD5 (128-bit) and SHA-1 (160-bit) have practical collision attacks; SHA-256 (256-bit) has none known.
- "Broken" is attack-specific: collision resistance can fall while other uses still stand.
- None of these functions — including SHA-256 — is a safe way to store passwords. They are too fast.
- For fingerprints and verification today, SHA-256 is the default; SHA-512 where its speed on 64-bit systems helps.
The numbers first
| Function | Output size | Hex characters | Collision status |
|---|---|---|---|
| MD5 | 128 bits | 32 | Broken — collisions are cheap; chosen-prefix collisions demonstrated |
| SHA-1 | 160 bits | 40 | Broken — first public collision in 2017 (SHAttered); chosen-prefix by 2020 |
| SHA-224 | 224 bits | 56 | No practical attacks known |
| SHA-256 | 256 bits | 64 | No practical attacks known |
| SHA-384 | 384 bits | 96 | No practical attacks known |
| SHA-512 | 512 bits | 128 | No practical attacks known; often fastest on 64-bit CPUs |
Output size sets the ceiling on security: a perfect n-bit hash resists collisions up to about 2n/2 work (the birthday bound) and preimage attacks up to 2n. MD5's ceiling was therefore always 264 for collisions — within sight of well-funded attackers even before its structural weaknesses were found. SHA-256's collision ceiling of 2128 is beyond any plausible brute force, which is why cryptanalysis, not size, would have to break it first.
What the attacks actually were
MD5 fell in stages: collision weaknesses shown in 2004, then chosen-prefix collisions — where an attacker picks both starting documents — which enabled a famous 2008 demonstration of a rogue certificate authority certificate, and the Flame malware's forged Microsoft signature in 2012. SHA-1's fall was slower but just as final: Google and CWI Amsterdam published two different PDFs with the same SHA-1 hash in 2017, at a cost of roughly 6,500 CPU-years and 110 GPU-years of computation, and chosen-prefix attacks followed in 2020 at a cost reported around tens of thousands of dollars in rented compute.
Notice the pattern: these are collision results. Nobody has a practical preimage attack on either function — given a hash, finding any input that produces it remains infeasible even for MD5. That distinction is exactly why an MD5 checksum still detects a corrupted download (random damage does not engineer collisions) while MD5 must never be used where an adversary chooses the inputs: signatures, certificates, or identity of untrusted files.
The job none of them may do: storing passwords
Password storage needs the opposite of what these functions offer. A password hash must be slow, salted and memory-hard, because the attacker's whole strategy is trying billions of candidates. MD5 and the SHA family are engineered for speed — a single modern GPU computes tens of billions of MD5 hashes per second — so a leaked database of SHA-256 password hashes falls to dictionary and rule-based attacks at industrial pace, whatever the digest size.
The correct tools are password-hashing functions: Argon2id (the current recommendation), bcrypt, or scrypt, each with a unique salt per user and a work factor tuned so one verification takes a noticeable fraction of a second. If you see a system storing passwords as a bare SHA-256, the finding to report is not "weak algorithm choice" — it is "passwords effectively stored recoverable".
So what is each one for, in 2026?
- SHA-256 / SHA-512: fingerprints, download verification, content addressing, integrity in protocols, building HMACs. The safe default whenever a hash leaves your machine.
- SHA-1: legacy fingerprints and one famous non-security role — Git object IDs (Git is migrating, and its use was never about adversarial collisions alone). Acceptable to read, unwise to mint for security purposes.
- MD5: internal checksums where every input is trusted and the only enemy is corruption — cache keys, change detection in your own pipeline, deduplication hints that are double-checked by other means.
- Any of them: never for passwords, never for signing, and never as a homemade encryption scheme.
Mistakes and pitfalls
Hashing a password twice, or with SHA-512, to make it safe
Speed is the problem, not digest length. A fast 512-bit hash is cracked at the same GPU pace as a fast 256-bit one. Salt plus a deliberately slow function is the fix, not more rounds of a fast one.
Encrypting with a hash
Hashing is one-way; there is no key and no decryption. Designs that "encrypt" data by hashing it either lose the data or are actually doing something else. For confidentiality you need an encryption algorithm; for tamper evidence you need a MAC or a signature.
Comparing hashes to prove two files are identical in a dispute with an untrusted party
With MD5 and increasingly SHA-1, the other party may be able to manufacture the collision. Evidence-grade comparisons belong on SHA-256 or stronger, with the hashing done in front of both parties where it matters.
Common questions
Why is SHA-512 sometimes faster than SHA-256?
SHA-512 works on 64-bit words, so on 64-bit processors each round does more work per instruction. On large inputs it can beat SHA-256 by a comfortable margin. On 32-bit hardware the advantage reverses.
What about SHA-3 and BLAKE2/3?
Both are excellent, standardised (SHA-3) or widely deployed (BLAKE2 is in countless tools; BLAKE3 is dramatically fast). Nothing in this article argues against them — SHA-256 is simply the most universally available, which matters when the other party must reproduce your hash.
How can I tell which algorithm produced a bare hex string?
By length, with ambiguity: 32 hex characters is MD5-sized, 40 is SHA-1-sized, 64 is SHA-256-sized, 128 is SHA-512-sized. Length identifies the family, not the exact function — SHA-224 and truncated variants complicate certainty, so label your hashes when you publish them.
To wrap up
The one-line history — MD5 broken, SHA-1 broken, SHA-2 fine — is a decent memory aid and a poor engineering guide. Know which attack matters for your use, and the right choice usually makes itself: SHA-256 for fingerprints that leave the building, slow salted functions for passwords, and legacy hashes only where adversaries are not part of the threat model.
Try it yourself
The hash generator computes all five digests of your text or file side by side in the browser, which makes comparisons like the ones in this article a ten-second experiment rather than an act of faith.