MD5 vs SHA-256 vs SHA-512: Which Hash to Use?
MD5, SHA-256, and SHA-512 compared: collision resistance, speed, and use cases. Learn which hash for file verification, password storage, and data integrity.
What Is a Hash Function?
A cryptographic hash function takes an input of any size and produces a fixed-size output called a digest. The same input always produces the same digest. Change a single bit in the input and the output changes completely. This is called the avalanche effect.
Hashing is a one-way operation. You cannot reverse a hash digest to recover the original input, unlike encryption which has a decryption key. This property makes hashing useful for integrity checks and password storage.
Common uses:
- File integrity: verify a downloaded file has not been corrupted
- Password storage: store hashes, not plaintext passwords
- Digital signatures: sign a hash of a document, not the whole document
- Deduplication: identify identical files by their hash
- Commit identifiers: Git uses SHA-1 (and increasingly SHA-256) to name every commit, tree, and blob
MD5: Fast but Broken
MD5 produces a 128-bit (16-byte, 32-hex-character) digest. It was designed in 1991 by Ron Rivest and was widely used throughout the 1990s and 2000s.
MD5 is cryptographically broken. Researchers have demonstrated practical collision attacks, two different inputs that produce the same MD5 hash. A notable case: in 2012, the Flame malware exploited an MD5 collision to forge a Microsoft digital certificate. In 2008, researchers used MD5 collisions to create a rogue Certificate Authority certificate.
These are not theoretical. You can generate two different PDF files with the same MD5 hash using publicly available tools. The attack takes seconds on a consumer laptop.
MD5 is still fast and occasionally used for non-security checksums (detecting accidental corruption, not malicious tampering), but it should never be used for security purposes. Even for checksums, SHA-256 is a better choice because the performance difference is negligible on modern hardware.
echo -n "hello" | md5sum
# 5d41402abc4b2a76b9719d911017c592
SHA-256: The Default
SHA-256 is part of the SHA-2 family, standardized by NIST in 2001. It produces a 256-bit (32-byte, 64-hex-character) digest. It is the default choice for most applications today.
Where SHA-256 is used:
- Git uses SHA-256 for object hashing in newer repository formats.
- TLS certificates rely on SHA-256 for certificate signatures. The entire web PKI infrastructure depends on it.
- Blockchain systems like Bitcoin use double SHA-256 for proof-of-work.
- Debian and most Linux distributions publish SHA-256 checksums for all packages.
- Docker image manifests are addressed by SHA-256 content digests.
No practical collision has ever been found for SHA-256. The best known attack reduces the complexity from 2^128 to 2^125.5, which is still far beyond reachable computation. For all practical purposes, SHA-256 is collision-free.
echo -n "hello" | sha256sum
# 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-512: Wider, but Mind the Platform
SHA-512 is also part of SHA-2. It produces a 512-bit (64-byte, 128-hex-character) digest.
On 64-bit processors, SHA-512 is actually faster than SHA-256 because it operates on 64-bit words, the native word size of the CPU. SHA-256 operates on 32-bit words, which means a 64-bit CPU does extra work per round. On 32-bit systems, SHA-512 is slower because it must simulate 64-bit operations across two registers.
When to consider SHA-512:
- You need stronger theoretical collision resistance (2^256 vs 2^128)
- You are running on 64-bit servers where the wider output is a free performance win
- You are complying with a standard that mandates SHA-512
The output is twice as long, which matters for storage and bandwidth. If you are hashing millions of database rows, the extra 32 bytes per row adds up.
echo -n "hello" | sha512sum
# 9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673c...
SHA-3 and BLAKE3: The Newer Alternatives
SHA-3 (standardized 2015) uses a different internal construction (sponge function) than SHA-2. It is not a replacement for SHA-2 but an alternative with a different design. If an attack is found against SHA-2's Merkle-Damgard structure, SHA-3 is not affected.
BLAKE3 is a newer hash function (2020) designed for speed. On modern CPUs with SIMD instructions, BLAKE3 is dramatically faster than SHA-256, often by an order of magnitude. It supports parallel hashing and verified streaming. If you are starting a new project and performance matters, consider BLAKE3. For compatibility with existing infrastructure, SHA-256 remains the safe choice.
Which to Use When
- MD5: only for legacy non-security checksums where you have no choice. Prefer SHA-256 even for accidental corruption detection.
- SHA-256: the safe default for file verification, digital signatures, and general integrity checks. Supported everywhere.
- SHA-512: when you need the widest digest and run on 64-bit hardware. A slight performance win on servers, but the larger output costs storage.
For password storage specifically, do not use any raw hash function. Use a purpose-built password hashing algorithm like bcrypt, scrypt, or Argon2. These are deliberately slow and memory-hard to resist brute-force attacks. A single SHA-256 of a password can be computed billions of times per second on a GPU. bcrypt limits that to thousands per second.
Hashing Is Not Encryption
Hashing and encryption are fundamentally different operations with different goals:
- Encryption is reversible with a key. You decrypt to get the original data.
- Hashing is one-way. You cannot get the original data from a hash.
If someone says "we encrypt your passwords with SHA-256," they are describing it wrong. Passwords are hashed, not encrypted. If a service can email you your plaintext password when you click "forgot password," they are storing passwords in plaintext or with reversible encryption. Both are red flags.
Try it yourself: open the Hash Calculator, type
hello, and compute the MD5, SHA-256, and SHA-512 digests. Compare the output lengths: 32 hex chars for MD5, 64 for SHA-256, and 128 for SHA-512. ChangehellotoHello(capital H) and watch every character in the digest change. This is the avalanche effect. Now type a 1,000-word paragraph and hash it. The output length does not change. That is the fixed-size property.