MD5 vs SHA-256: What's the Difference and Which Should You Use?

MD5 and SHA-256 are two of the most common hash functions you’ll meet — in download pages, Git, certificates and countless tutorials. They do the same basic job, but one is broken and one is the modern standard. Here’s the difference, when each is appropriate, and two mistakes people make with both of them.

The short answer

	MD5	SHA-256
Digest size	128-bit (32 hex chars)	256-bit (64 hex chars)
Year / family	1991 (Rivest)	SHA-2 family, NIST (2001)
Security	Broken — collisions in seconds	No known practical attack
Speed	Faster	Slower (but SHA-NI narrows it)
Use for security?	No	Yes
Still fine for	Non-adversarial integrity checks	Everything, including the above

In one line: use SHA-256 for anything where an attacker might tamper with the data; MD5 is only acceptable for catching accidental corruption — and neither should ever hash a password.

What a hash function does (quickly)

A cryptographic hash turns any input into a fixed-length “fingerprint” (the digest). Good hash functions have three properties:

• Deterministic — the same input always gives the same digest.
• One-way (preimage resistance) — you can’t recover the input from the digest.
• Collision resistant — you can’t find two different inputs with the same digest.

Change one character and the digest changes completely:

MD5("hello")     = 5d41402abc4b2a76b9719d911017c592
SHA-256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

The headline difference between MD5 and SHA-256 is that MD5 fails the collision- resistance property, and SHA-256 doesn’t.

1. Security — the difference that matters

MD5 is cryptographically broken. Practical collision attacks have existed since the mid-2000s: you can generate two different files with the same MD5 digest in seconds on a laptop. Worse, chosen-prefix collisions (where an attacker picks meaningful content for both files) have been used in the wild:

• In 2008, researchers built a rogue certificate authority certificate using an MD5 chosen-prefix collision — effectively forging a trusted signer.
• In 2012, the Flame malware used a forged, MD5-collision-based code-signing certificate to appear as legitimate Microsoft-signed software.

Because of this, the IETF’s RFC 6151 states plainly that MD5 must not be used where collision resistance is required.

SHA-256 has no such weakness. There is no known collision or preimage attack faster than brute force, which is computationally infeasible for a 256-bit digest. It’s the workhorse behind TLS certificates, code signing, Git’s SHA-256 object format, and the checksums on reputable download pages.

The practical test: could an attacker swap the data for something with the same digest? If yes, you need SHA-256. MD5 only “works” when nobody is trying to fool you.

2. Output size

MD5 is 128-bit (32 hex characters); SHA-256 is 256-bit (64 hex characters). The larger space is part of why SHA-256 resists collisions: there are vastly more possible digests, and — unlike MD5 — no shortcut is known to engineer a match. You can see both side by side for any input in our Hash Calculator.

3. Speed — real, but usually the wrong thing to optimise

MD5 is faster than SHA-256 in pure software (often roughly 2–3×). That sounds like a point in MD5’s favour, but it almost never is:

• For security, MD5’s speed is irrelevant because it’s broken.
• For integrity at scale (hashing huge amounts of data where no attacker is involved), the gap matters a little — but modern CPUs include SHA-NI instructions that accelerate SHA-256 in hardware, narrowing it considerably.
• For passwords, being fast is actively bad (see below).

So speed only tips toward MD5 in non-adversarial, high-volume integrity work — and even there, SHA-256 is a defensible default.

Where each is actually appropriate

• Reach for SHA-256 when integrity has to hold up against a motivated attacker: verifying a downloaded installer against a published checksum, certificates, code signing, content-addressed storage you can’t let someone poison, or anywhere the result is a security decision. (Our guide to verifying files with checksums walks through this in practice.)
• MD5 is still acceptable for purely non-adversarial checks: detecting accidental corruption during a file copy or transfer, deduplicating files you control, or quick cache keys — cases where nobody benefits from forging a match. Even then, SHA-256 costs little extra and removes the footgun.

Two mistakes people make with both

Don’t use MD5 or SHA-256 to hash passwords

This is the big one. The problem with plain MD5/SHA-256 for passwords isn’t that they’re “broken” — it’s that they’re fast. A GPU can compute billions of SHA-256 hashes per second, so switching passwords from MD5 to SHA-256 barely slows an attacker’s guessing. Passwords need a function that’s deliberately slow, salted and memory-hard:

• Argon2id — the modern first choice.
• scrypt or bcrypt — solid, widely supported alternatives.

(And users should still pick strong passwords — see our strong passwords guide and the Password Generator.)

Don’t build a MAC with naive hash(secret + message)

Both MD5 and SHA-256 use the Merkle–Damgård construction, which makes them vulnerable to length-extension attacks: given H(secret || message) and the length of the secret, an attacker can compute a valid digest for message || extra without knowing the secret. That breaks naive “secret-prefix” message authentication. The fix is HMAC (e.g. HMAC-SHA256), which nests the hash to defeat the attack. (SHA-3 and the BLAKE family aren’t length-extendable, but HMAC is the standard answer.)

Which should you use?

1. Security / anti-tamper integrity? → SHA-256.
2. Catching accidental corruption only, no attacker? → MD5 is acceptable, SHA-256 is the safer default.
3. Passwords? → Neither — Argon2id / scrypt / bcrypt.
4. Message authentication? → HMAC-SHA256, not raw hashing.

Beyond MD5 and SHA-256

SHA-256 is not the end of the line. SHA-3 (Keccak) is a NIST standard with a different internal design and no length-extension weakness, and BLAKE3 is a fast, modern option. For most applications today, though, SHA-256 remains the safe, universally supported default — and it’s a strict upgrade over MD5 in every security sense.

Try it yourself

Our free, browser-based Hash Calculator computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for any text, side by side — entirely in your browser via the Web Crypto API, so nothing you type is uploaded. Paste the same input and watch how the MD5 and SHA-256 digests differ in length and value.

References

• NIST — FIPS 180-4, Secure Hash Standard (the SHA-2 family, including SHA-256): csrc.nist.gov.
• IETF — RFC 6151, Updated Security Considerations for MD5: ietf.org/rfc/rfc6151.
• On MD5 chosen-prefix collisions and their real-world abuse (rogue CA cert, Flame): dev.to overview.
• OWASP — Password Storage Cheat Sheet (why to use Argon2id/scrypt/bcrypt): cheatsheetseries.owasp.org.