# MD5 vs SHA-1 vs SHA-256 vs SHA-512: Which Hash to Use

> MD5 and SHA-1 have known collisions; SHA-256 and SHA-512 are NIST-approved. Digest sizes, security strengths, and why none of them should store passwords.

- URL: https://generate.now/guides/md5-vs-sha1-vs-sha256
- Published by: Hyperdusk Ltd (https://hyperdusk.com)
- Published: 2026-11-11
- Last updated: 2026-11-11

## The short answer

MD5 and SHA-1 are broken for collision resistance: different inputs with the same digest have been produced for both. SHA-256 and SHA-512 are NIST-approved, with 128 and 256 bits of collision resistance. Use SHA-256 for checksums and signatures. Use none of the four to store passwords, which needs a slow function such as Argon2id or bcrypt.

## Key differences

**MD5, SHA-1, SHA-256 and SHA-512 side by side**

|   | MD5 | SHA-1 | SHA-256 | SHA-512 |
| --- | --- | --- | --- | --- |
| Digest size | 128 bits | 160 bits | 256 bits | 512 bits |
| Length as hex | 32 characters | 40 characters | 64 characters | 128 characters |
| Specified in | RFC 1321 | FIPS 180-4 | FIPS 180-4 (SHA-2) | FIPS 180-4 (SHA-2) |
| Collision resistance | Broken: collisions found in seconds on a PC | Broken: first collision published in 2017 | 128-bit strength (NIST) | 256-bit strength (NIST) |
| Standing | Not acceptable where collision resistance is required | Deprecated by NIST; to be phased out by the end of 2030 | NIST-approved | NIST-approved |
| Reasonable use today | Detecting accidental corruption; matching an existing checksum | Matching an existing checksum | Checksums, signatures, HMAC | As SHA-256, where a longer digest is specified |

_Hex lengths checked by hashing the string "abc" with Node.js crypto._

## What does "broken" mean for MD5 and SHA-1?

A cryptographic hash is expected to resist three things: finding two inputs with the same digest (a collision), finding an input for a given digest (a preimage), and finding a second input that matches a given input's digest (a second preimage). MD5 and SHA-1 have failed the first.

For MD5, RFC 6151 records that the first collision pairs were published in 2004, that later attacks find a collision in about a minute on a notebook PC, with one paper claiming 10 seconds or less, and that the attacks were applied to X.509 certificates. It concludes that MD5 is no longer acceptable where collision resistance is required, such as digital signatures. Preimage resistance has held up better: the best attack the RFC cites still needs about 2^123.4 work.

For SHA-1, researchers at CWI Amsterdam and Google announced the first practical collision on 23 February 2017: two PDF files with different content and the same SHA-1 digest. They report it took 9,223,372,036,854,775,808 SHA-1 computations, which is 2^63, using 6,500 years of CPU time and 110 years of GPU time.

## Is SHA-1 still allowed?

For new work, no. NIST deprecated SHA-1 in 2011 and disallowed it for digital signatures at the end of 2013. In December 2022 it announced that SHA-1 should be phased out everywhere by 31 December 2030 and recommended that anyone relying on it for security move to SHA-2 or SHA-3.

Existing identifiers and published checksums that use SHA-1 still work as identifiers. What is lost is the guarantee that nobody can construct two files with the same value.

## Should I use SHA-256 or SHA-512?

Both belong to the SHA-2 family in FIPS 180-4, and NIST approves both. NIST rates a hash's collision resistance at half its output size and its preimage resistance at its full output size.

**NIST security strengths of approved hash functions**

| Algorithm | Digest | Collision resistance | Preimage resistance |
| --- | --- | --- | --- |
| SHA-1 | 160 bits | Under 80 bits | 160 bits |
| SHA-256 | 256 bits | 128 bits | 256 bits |
| SHA-384 | 384 bits | 192 bits | 384 bits |
| SHA-512 | 512 bits | 256 bits | 512 bits |
| SHA3-256 | 256 bits | 128 bits | 256 bits |

_Read from the security-strength table on NIST's Hash Functions page. MD5 is not in the table because it is not a NIST-approved algorithm._

Pick the one your protocol, package manager or published checksum already uses. If nothing dictates it, SHA-256 gives the shorter digest: half as long to store and compare. SHA-3 is an approved alternative with a different internal design.

## Why should none of them store passwords?

Because they are fast. The OWASP Password Storage Cheat Sheet says fast hashing algorithms such as SHA-256 are not suitable for password storage because they let an attacker make large numbers of guesses quickly. Password hashing needs a function that is slow on purpose, salted per password, and adjustable as hardware improves.

**OWASP minimum settings for password hashing**

| Algorithm | Minimum configuration | When OWASP says to use it |
| --- | --- | --- |
| Argon2id | 19 MiB of memory, 2 iterations, parallelism 1 | First choice |
| scrypt | Cost 2^17, block size 8, parallelism 1 | If Argon2id is not available |
| bcrypt | Work factor 10 or more; 72-byte password limit | Legacy systems |
| PBKDF2-HMAC-SHA256 | 600,000 iterations | If FIPS-140 compliance is required |

_As stated in the OWASP Password Storage Cheat Sheet on 11 November 2026. OWASP revises these numbers, so check the sheet before copying them._

bcrypt is a password hashing function, not a checksum: its output is a 60-character string that contains the work factor and a random salt, so hashing the same password twice gives two different strings. OWASP now says bcrypt should only be used in legacy systems where Argon2 and scrypt are not available.

## Is HMAC-MD5 broken too?

Not in the same way. HMAC combines the hash with a secret key, and RFC 6151 says the published attacks on HMAC-MD5 "do not seem to indicate a practical vulnerability when used as a message authentication code". Its guidance is that it is not urgent to remove HMAC-MD5 from existing protocols, but that new protocol designs should not use it. It names HMAC-SHA256 as an alternative.

## Which should you use?

Use SHA-256 by default for file checksums, content addressing, signatures and HMAC. Use SHA-512 when a specification asks for it. Use MD5 or SHA-1 only to match a checksum that someone else already published in that format, and never where an attacker could choose the input.

For passwords, use Argon2id, or scrypt, bcrypt or PBKDF2 where your platform requires it, with the settings OWASP currently lists.

## Tools for this

- [Generate an MD5, SHA-1, SHA-256 or SHA-512 hash](https://generate.now/hash): Hash Generator. Hashes text or a file in the browser, compares the result with a published checksum, and creates or verifies bcrypt hashes.

## Sources

Primary sources, read on 2026-11-11.

- [RFC 6151: Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms](https://www.rfc-editor.org/rfc/rfc6151): IETF. The history of MD5 collision attacks, the preimage bound, and the guidance on MD5 and HMAC-MD5.
- [Hash Functions](https://csrc.nist.gov/projects/hash-functions): NIST Computer Security Resource Center. The approved algorithms in FIPS 180-4 and FIPS 202, SHA-1's deprecation dates and the security-strength table.
- [NIST Retires SHA-1 Cryptographic Algorithm](https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm): NIST. The 31 December 2030 phase-out date and the recommendation to move to SHA-2 or SHA-3.
- [Announcing the first SHA1 collision](https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html): Google Security Blog. The 2017 collision by CWI Amsterdam and Google, and the computation it required.
- [Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html): OWASP. Why fast hashes are unsuitable for passwords, and the current Argon2id, scrypt, bcrypt and PBKDF2 settings.

## Related guides

- [UUID v4 vs v7: Differences and Which to Use](https://generate.now/guides/uuid-v4-vs-v7): UUID v4 is 122 random bits. UUID v7 starts with a millisecond timestamp, so IDs sort by creation time. Bit layouts, collision odds and when to use each.
- [UUID vs ULID vs Nano ID: Size, Sorting and Collisions](https://generate.now/guides/uuid-vs-ulid-vs-nanoid): UUID, ULID and Nano ID compared: length, alphabet, random bits, whether they sort by time, and computed collision odds. With a guide to choosing one.
- [Password vs Passphrase: Which Is Stronger?](https://generate.now/guides/password-vs-passphrase): A random 12-character password and a six-word passphrase are about equally strong. Entropy tables for both, and what NIST SP 800-63B says about length.

[All guides](https://generate.now/guides)