MD5 vs SHA-1 vs SHA-256 vs SHA-512: Which Hash Should You Actually Use?
Hashing Isn't One-Size-Fits-All
A cryptographic hash takes an input of any size and produces a fixed-length fingerprint. The catch is that not every hash function is safe for every job. Some are fast and fine for checksums, others are required for anything security-sensitive.
MD5: Fast, but Broken for Security
MD5 is still everywhere for non-security checksums: verifying a file downloaded correctly, deduplicating content, or generating a cache key. It is not safe for passwords, signatures, or anything where an attacker might try to forge a collision; practical collision attacks against MD5 have existed for years.
SHA-1: Deprecated
SHA-1 was the web's default for a long time but is now considered broken for security purposes after real-world collision attacks. Browsers and certificate authorities have phased it out. If you see SHA-1 in a security context in your own code, it's worth migrating.
SHA-256: The Reasonable Default
Part of the SHA-2 family, SHA-256 is the standard choice today for file integrity, blockchain applications, TLS certificates, and general-purpose secure hashing. It's fast, well supported natively in every language, and has no known practical attacks.
SHA-512: For Larger Margins or 64-bit Systems
SHA-512 produces a longer digest and can actually be faster than SHA-256 on 64-bit hardware because it operates on 64-bit words. Use it when you want extra headroom or are hashing very large payloads.
What About Passwords?
None of the above. MD5, SHA-256, and SHA-512 are all fast hash functions, great for integrity checks, terrible for passwords, because fast hashing is exactly what makes brute-forcing cheap. Passwords need a slow, memory-hard function like bcrypt, scrypt, or Argon2, not a general-purpose hash.
Try It Yourself
The Hash Generator computes SHA-1, SHA-256, and SHA-512 digests for any text directly in your browser, handy for verifying checksums or generating cache keys without installing a CLI tool. For a full unique identifier instead of a content hash, see the UUID / ULID Generator.