| Algorithm | Output length | Speed | Security status |
|---|---|---|---|
| MD5 | 128-bit (32 hex chars) | Very fast | Broken — collisions are trivial |
| SHA-1 | 160-bit (40 hex chars) | Fast | Broken — practical collision attacks exist |
| SHA-256 | 256-bit (64 hex chars) | Fast | Secure, the current default standard |
| SHA-512 | 512-bit (128 hex chars) | Fast (faster than SHA-256 on 64-bit CPUs) | Secure, extra margin |
A cryptographic hash function is only as good as its resistance to collisions — two different inputs that produce the same output digest. Both MD5 and SHA-1 have had practical collision attacks demonstrated against them: researchers have crafted pairs of different files (and even different PDFs and executables) that hash to the identical MD5 or SHA-1 value. That breaks the fundamental guarantee a security-grade hash is supposed to provide — that a digest uniquely fingerprints its input.
This isn't purely theoretical. The severity of the SHA-1 collision findings was significant enough that major version control and software ecosystems took notice — Git, for instance, which historically identified every commit by a SHA-1 hash, has worked on transitioning toward SHA-256 object IDs specifically because of these collision concerns. Browsers and certificate authorities also phased out SHA-1 for TLS certificates years ago for the same reason.
Still genuinely useful for things that don't involve an adversary: detecting accidental file corruption during a transfer, deduplicating uploads, or generating a quick cache key from a chunk of data. Fast, short, and universally supported. Just never rely on it anywhere someone might deliberately try to forge a matching hash.
Same story as MD5 but with a slightly larger output. You'll still encounter it in legacy systems, older Git internals, and some checksum tooling — fine to read/support for compatibility, not something to choose for new security-sensitive work.
Part of the SHA-2 family and the default choice for essentially all modern security-sensitive hashing: TLS certificate fingerprints, JWT (JSON Web Token) signatures, Bitcoin and most blockchain proof-of-work, package manager checksums, and Git's ongoing migration away from SHA-1. No practical collision or preimage attacks are known against SHA-256 at the time of writing. If you're not sure which hash to reach for, this is the safe default.
Also part of the SHA-2 family, with a 512-bit output instead of 256-bit. Not meaningfully "more secure" against any known practical attack today, but it gives you a larger security margin for very long-term integrity guarantees, and — somewhat counterintuitively — it can actually run faster than SHA-256 on 64-bit hardware because its internal operations are optimized for 64-bit words. Reach for it when you want extra headroom or are already working with 64-bit-optimized cryptographic pipelines.
MD5, SHA-1, SHA-256, and SHA-512 are all general-purpose hash functions, designed to be computed as fast as possible. That's exactly the wrong property for hashing passwords: a fast hash lets an attacker who steals your password database try billions of guesses per second on cheap GPU hardware. Use a deliberately slow, purpose-built password hashing algorithm instead — bcrypt, scrypt, or Argon2 — which are designed to make brute-forcing computationally expensive even at scale.
Paste any text and get MD5, SHA-1, SHA-256, and SHA-512 side by side, instantly, free, entirely in your browser.
Open Hash Generator →