MD5 vs SHA-1 vs SHA-256 vs SHA-512: Which Hash to Use
Last updated Published by Hyperdusk Ltd
The short answer
MD5 and SHA-1 are broken for collision resistance: different inputs with the same digest have been produced for both. SHA-256 and SHA-512 are NIST-approved, with 128 and 256 bits of collision resistance. Use SHA-256 for checksums and signatures. Use none of the four to store passwords, which needs a slow function such as Argon2id or bcrypt.
Generate an MD5, SHA-1, SHA-256 or SHA-512 hash →Key differences
| MD5 | SHA-1 | SHA-256 | SHA-512 | |
|---|---|---|---|---|
| Digest size | 128 bits | 160 bits | 256 bits | 512 bits |
| Length as hex | 32 characters | 40 characters | 64 characters | 128 characters |
| Specified in | RFC 1321 | FIPS 180-4 | FIPS 180-4 (SHA-2) | FIPS 180-4 (SHA-2) |
| Collision resistance | Broken: collisions found in seconds on a PC | Broken: first collision published in 2017 | 128-bit strength (NIST) | 256-bit strength (NIST) |
| Standing | Not acceptable where collision resistance is required | Deprecated by NIST; to be phased out by the end of 2030 | NIST-approved | NIST-approved |
| Reasonable use today | Detecting accidental corruption; matching an existing checksum | Matching an existing checksum | Checksums, signatures, HMAC | As SHA-256, where a longer digest is specified |
What does "broken" mean for MD5 and SHA-1?
A cryptographic hash is expected to resist three things: finding two inputs with the same digest (a collision), finding an input for a given digest (a preimage), and finding a second input that matches a given input's digest (a second preimage). MD5 and SHA-1 have failed the first.
For MD5, RFC 6151 records that the first collision pairs were published in 2004, that later attacks find a collision in about a minute on a notebook PC, with one paper claiming 10 seconds or less, and that the attacks were applied to X.509 certificates. It concludes that MD5 is no longer acceptable where collision resistance is required, such as digital signatures. Preimage resistance has held up better: the best attack the RFC cites still needs about 2^123.4 work.
For SHA-1, researchers at CWI Amsterdam and Google announced the first practical collision on 23 February 2017: two PDF files with different content and the same SHA-1 digest. They report it took 9,223,372,036,854,775,808 SHA-1 computations, which is 2^63, using 6,500 years of CPU time and 110 years of GPU time.
Is SHA-1 still allowed?
For new work, no. NIST deprecated SHA-1 in 2011 and disallowed it for digital signatures at the end of 2013. In December 2022 it announced that SHA-1 should be phased out everywhere by 31 December 2030 and recommended that anyone relying on it for security move to SHA-2 or SHA-3.
Existing identifiers and published checksums that use SHA-1 still work as identifiers. What is lost is the guarantee that nobody can construct two files with the same value.
Should I use SHA-256 or SHA-512?
Both belong to the SHA-2 family in FIPS 180-4, and NIST approves both. NIST rates a hash's collision resistance at half its output size and its preimage resistance at its full output size.
| Algorithm | Digest | Collision resistance | Preimage resistance |
|---|---|---|---|
| SHA-1 | 160 bits | Under 80 bits | 160 bits |
| SHA-256 | 256 bits | 128 bits | 256 bits |
| SHA-384 | 384 bits | 192 bits | 384 bits |
| SHA-512 | 512 bits | 256 bits | 512 bits |
| SHA3-256 | 256 bits | 128 bits | 256 bits |
Pick the one your protocol, package manager or published checksum already uses. If nothing dictates it, SHA-256 gives the shorter digest: half as long to store and compare. SHA-3 is an approved alternative with a different internal design.
Why should none of them store passwords?
Because they are fast. The OWASP Password Storage Cheat Sheet says fast hashing algorithms such as SHA-256 are not suitable for password storage because they let an attacker make large numbers of guesses quickly. Password hashing needs a function that is slow on purpose, salted per password, and adjustable as hardware improves.
| Algorithm | Minimum configuration | When OWASP says to use it |
|---|---|---|
| Argon2id | 19 MiB of memory, 2 iterations, parallelism 1 | First choice |
| scrypt | Cost 2^17, block size 8, parallelism 1 | If Argon2id is not available |
| bcrypt | Work factor 10 or more; 72-byte password limit | Legacy systems |
| PBKDF2-HMAC-SHA256 | 600,000 iterations | If FIPS-140 compliance is required |
bcrypt is a password hashing function, not a checksum: its output is a 60-character string that contains the work factor and a random salt, so hashing the same password twice gives two different strings. OWASP now says bcrypt should only be used in legacy systems where Argon2 and scrypt are not available.
Is HMAC-MD5 broken too?
Not in the same way. HMAC combines the hash with a secret key, and RFC 6151 says the published attacks on HMAC-MD5 "do not seem to indicate a practical vulnerability when used as a message authentication code". Its guidance is that it is not urgent to remove HMAC-MD5 from existing protocols, but that new protocol designs should not use it. It names HMAC-SHA256 as an alternative.
Which should you use?
Use SHA-256 by default for file checksums, content addressing, signatures and HMAC. Use SHA-512 when a specification asks for it. Use MD5 or SHA-1 only to match a checksum that someone else already published in that format, and never where an attacker could choose the input.
For passwords, use Argon2id, or scrypt, bcrypt or PBKDF2 where your platform requires it, with the settings OWASP currently lists.
Tools for this
- Generate an MD5, SHA-1, SHA-256 or SHA-512 hash →
Hash Generator. Hashes text or a file in the browser, compares the result with a published checksum, and creates or verifies bcrypt hashes.
Sources
This page was written from the primary sources below, read on .
- RFC 6151: Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms
IETF. The history of MD5 collision attacks, the preimage bound, and the guidance on MD5 and HMAC-MD5.
- Hash Functions
NIST Computer Security Resource Center. The approved algorithms in FIPS 180-4 and FIPS 202, SHA-1's deprecation dates and the security-strength table.
- NIST Retires SHA-1 Cryptographic Algorithm
NIST. The 31 December 2030 phase-out date and the recommendation to move to SHA-2 or SHA-3.
- Announcing the first SHA1 collision
Google Security Blog. The 2017 collision by CWI Amsterdam and Google, and the computation it required.
- Password Storage Cheat Sheet
OWASP. Why fast hashes are unsuitable for passwords, and the current Argon2id, scrypt, bcrypt and PBKDF2 settings.