MD5 vs. SHA-256: which hash should you use?

A hash function takes input of any size and produces a fixed-size fingerprint. The same input always produces the same hash, and changing even a single character produces a completely different one. Beyond that shared definition, the algorithms differ a lot in output size, speed, and — critically — whether they're still considered secure.

MD5 (128-bit)

MD5 is fast and produces a short, 32-character hex digest, which is why it's still common for non-security purposes like cache keys, checksums for detecting accidental file corruption, or de-duplicating data. It is cryptographically broken: researchers can construct two different inputs that produce the same MD5 hash (a "collision") relatively cheaply. Never use it for passwords, digital signatures, or anywhere an attacker might benefit from forging a match.

SHA-1 (160-bit)

SHA-1 improved on MD5 but is also now considered broken — a practical collision was publicly demonstrated in 2017. It's still found in older systems (some Git internals historically used it) but shouldn't be chosen for anything new.

SHA-256 / SHA-384 / SHA-512

These are part of the SHA-2 family and are the current practical standard for general-purpose secure hashing — used in TLS certificates, Bitcoin, package integrity checks (like npm's integrity field), and much more. SHA-256 is the most common default; SHA-384 and SHA-512 produce longer digests and are marginally more resistant to certain theoretical attacks, at a small performance cost.

What none of these are for: passwords

This is the mistake worth flagging clearly: MD5, SHA-1, and even SHA-256/512 are all fast hash functions, which is exactly the wrong property for hashing passwords — it means an attacker with a stolen password database can try billions of guesses per second. Purpose-built password hashing functions like bcrypt, scrypt, or Argon2 are deliberately slow and memory-hard instead. If you're building authentication, use one of those, not a general-purpose hash from this list.