MD5 vs SHA-256: Hashing Algorithms Explained for Developers

A hash function takes an input of any size (a password, a file, a hard drive image) and produces a fixed-size string of characters, called a hash or digest.

Key Properties:

1. Deterministic: The same input always produces the same hash.
2. One-Way: You cannot "decrypt" a hash back to the original input.
3. Avalanche Effect: Changing just 1 bit of input drastically changes the output.
4. Collision Resistant: It should be impossible to find two inputs that produce the same hash.

1. MD5 (Message Digest 5) - The "Broken" One

MD5 is fast and produces a 128-bit hash. However, it is cryptographically broken. Researchers can generate collisions (two files with the same hash) in seconds.

Use for: Non-critical file integrity checks (checksums), caching keys.
Never use for: Passwords, digital signatures.

2. SHA-1 (Secure Hash Algorithm 1) - The "Retired" One

SHA-1 was the standard for SSL certificates for years until Google shattered it in 2017. Like MD5, it is no longer considered secure against well-funded attackers.

Use for: Legacy git repositories (Git still uses SHA-1 internally).
Never use for: New security systems.

3. SHA-256 (Secure Hash Algorithm 2) - The Standard

SHA-256 is the gold standard for security today. It powers Bitcoin, SSL certificates, and most secure apps. It produces a 256-bit hash that is computationally impossible to reverse or collide.

Use for: Everything requiring real security.

See how the output length differs for the input "hello":

Do not use simple hashes for passwords.

Even SHA-256 is too fast for password storage, making it vulnerable to brute-force attacks. For user passwords, always use slow algorithms specifically designed for the purpose, like bcrypt, Argon2, or PBKDF2.