Overview
MD5 and SHA-256 are both cryptographic hash functions, but they were designed in different eras and offer vastly different levels of security. MD5 was published in 1991 by Ron Rivest as an improvement over MD4. SHA-256, part of the SHA-2 family, was designed by the NSA and published by NIST in 2001.
MD5's collision resistance is broken, so it is unsuitable where an attacker could manipulate the input. SHA-256 remains specified by NIST's Secure Hash Standard and is a practical default for new checksum workflows. The surrounding protocol still matters: an unauthenticated hash alone does not establish who published a file.
Comparison Table
| Feature | MD5 | SHA-256 |
|---|---|---|
| Year Published | 1991 | 2001 |
| Output Length | 128 bits (32 hex chars) | 256 bits (64 hex chars) |
| Internal Rounds | 4 rounds (64 operations) | 64 rounds |
| Block Size | 512 bits | 512 bits |
| Speed | Implementation-dependent | Implementation-dependent |
| Collision Resistance | Broken | No practical collision attack publicly known |
| Security Status | Deprecated for security | Specified by NIST FIPS 180-4 |
| Use Cases | Non-security checksums, legacy systems | Checksums, digital signatures and protocol-defined uses; not plain password storage |
Why MD5 Is Considered Broken
In 2004, researchers demonstrated practical collision attacks against MD5, meaning they could generate two different inputs that produce the same hash. By 2008, researchers used MD5 collisions to create a rogue CA certificate, proving the vulnerability had real-world security implications.
Practical collision attacks mean MD5 cannot provide collision resistance against a capable attacker. IETF RFC 6151 says MD5 is no longer acceptable where collision resistance is required, although it may remain adequate for some error-detection uses where the threat is accidental corruption rather than an adversary.
Warning: Never use MD5 for password hashing, digital signatures, certificate verification, or any application where security matters.
When MD5 Is Still Acceptable
Despite its security flaws, MD5 remains useful in contexts where collision resistance is not required:
- Quick file identification: Detecting accidental corruption or identifying duplicate files in a trusted environment.
- Non-security checksums: Verifying data transfer integrity where malicious tampering is not a threat.
- Hash tables and caching: Internal data structures where the hash does not serve a security function.
- Legacy system compatibility: Interfacing with older systems that only support MD5.
When to Use SHA-256
SHA-256 should be your default choice for any application involving security:
- Password-derived keys: Use a purpose-built, salted and deliberately expensive password-hashing or key-derivation function; do not store a plain SHA-256 digest of a password.
- File integrity verification: Ensuring downloaded files have not been tampered with.
- Digital signatures: Code signing, document signing, and certificate verification.
- Blockchain and cryptocurrency: Bitcoin and many other blockchains use SHA-256 as their core hash function.
- TLS/SSL certificates: Modern web security relies on SHA-256 for certificate fingerprints.
See the Difference Yourself
Try hashing the same input with both algorithms using the hash generator. MD5 produces 32 hexadecimal characters (128 bits), while SHA-256 produces 64 (256 bits). Use the checksum calculator when you need to compare a downloaded file with a published value.
Sources and review date
MD5 security guidance follows IETF RFC 6151. SHA-256 output and algorithm details were checked against the NIST Secure Hash Standard. Last reviewed: .