MD5 vs SHA-256: Which Hash Should You Use

October 17, 2026 • NOFYI Editorial Team

If you have ever downloaded a file and seen a long string of letters and numbers next to it, you have met a hash. If you have ever wondered why some guides warn against MD5 and recommend SHA-256, this post explains the difference in plain language. Both MD5 and SHA-256 are hash functions. Both turn input, such as a word or a file, into a fixed-length fingerprint. But they are not equally safe, and choosing the wrong one can quietly undermine the security of a system. The short answer is that MD5 is broken for security purposes, and SHA-256 is the safer choice of the two. The rest of this post explains why, when each one is acceptable, and what to use instead when passwords are involved.

What Is a Hash Function?

A hash function takes input of any size and produces a fixed-size output called a hash value, digest, or checksum. The same input always produces the same output. A tiny change in the input produces a completely different output. It is easy to compute the hash of a given input, but it should be very hard to work backwards from a hash to the original input, and very hard to find two different inputs that produce the same hash. That last property, resistance to collisions, is where MD5 fails.

Hashes are used in many everyday places. Download pages publish a hash so you can confirm the file you received matches the file the publisher released. Version control systems use hashes to identify content. Databases and caches use hashes to look things up quickly. Security systems use hashes to verify that data has not been changed. The right hash for the job depends on what you are protecting and who might try to break it.

Deterministic: the same input always gives the same hash.
Fixed length: the output is always the same size, no matter how big the input is.
Sensitive to change: changing one character changes the whole hash.
One-way: you cannot easily recover the input from the hash.
Collision resistant: it should be very hard to find two inputs with the same hash.

MD5: Fast, Familiar, and Broken for Security

MD5 was designed in the early 1990s and became widely used because it is fast and simple. It produces a 128-bit digest, usually written as 32 hexadecimal characters. Hexadecimal means the characters 0 to 9 and a to f, so an MD5 hash looks like a 32-character string of those characters. For many years, MD5 was the default choice for checksums and for storing password hashes. That changed as researchers found weaknesses in it.

The core problem with MD5 is collisions. Researchers have shown that it is practical to create two different inputs that produce the same MD5 hash. That breaks one of the basic promises of a hash function. If an attacker can produce a harmless-looking file and a malicious file with the same MD5 hash, then an MD5 checksum cannot tell them apart. MD5 is also fast, which is a disadvantage when hashes are used to protect passwords, because speed helps an attacker who is guessing passwords. For these reasons, MD5 should not be used for security purposes, such as digital signatures, certificates, or password storage.

That does not mean MD5 is useless for everything. It can still be used as a simple, non-security checksum where the only threat is accidental corruption, not a deliberate attacker. Even then, SHA-256 is usually a better default, because it costs little extra and removes the doubt. If you see MD5 in an old system, treat it as a warning sign, not as a guarantee.

SHA-256: The Safer Choice of the Two

SHA-256 is part of the SHA-2 family of hash functions. It produces a 256-bit digest, usually written as 64 hexadecimal characters, which is twice as long as an MD5 hash. The longer output is one reason collisions are far harder to find. SHA-256 has no known practical collision attack of the kind that broke MD5, and it remains widely trusted for verifying downloads, securing communications, and building systems that need a strong hash.

SHA-256 is slower than MD5, but for most uses the difference does not matter. Verifying a downloaded file takes a moment either way. The extra security is worth it. SHA-256 is the default recommendation whenever you need a general-purpose hash and you are choosing between these two options. If a guide, a tool, or a download page offers both MD5 and SHA-256, use the SHA-256 value.

Seeing the Difference: Hashing the Word Hello

The difference is easiest to see with a concrete example. Take the word hello, all lowercase, with no spaces and no punctuation. The MD5 hash of hello is:

5d41402abc4b2a76b9719d911017c592

Count the characters and you will find 32. Now hash the same word with SHA-256:

2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

Count the characters and you will find 64. Both hashes describe the same five-letter word, but the SHA-256 output is twice as long and comes from a stronger function. If you change one letter, for example hello to hallo, both hashes change completely. That avalanche effect is a property of good hash functions, and it is why hashes are useful for detecting changes.

You can try this yourself with a hash calculator or a command-line tool. On many systems, the commands echo -n hello | md5sum and echo -n hello | sha256sum will reproduce these values, provided the tool is available and the input has no trailing newline. The point is not the command itself. The point is that the same input gives the same hash every time, on any system, and that the two functions give different fingerprints of different lengths.

MD5 vs SHA-256 at a Glance

Output length: MD5 produces a 32-character hexadecimal hash. SHA-256 produces a 64-character hexadecimal hash.
Security: MD5 is broken for security purposes because practical collisions exist. SHA-256 has no known practical collision attack.
Speed: MD5 is faster, which helps attackers when passwords are involved. SHA-256 is slower but still fast for normal use.
Common uses: MD5 survives in old systems and non-security checksums. SHA-256 is the standard for download verification and modern security work.
Recommendation: choose SHA-256 whenever you are deciding between the two.

Checksums: Verifying a File You Downloaded

One of the most common uses of a hash is a checksum. When you download a file, the publisher may publish the SHA-256 hash of the original file. After downloading, you compute the hash of the file you received. If the two hashes match, the file is almost certainly the same one the publisher released. If they differ, something changed during the download, or the file came from a different source, and you should not trust it.

Find the published hash. Look for a SHA-256 checksum on the official download page.
Compute the hash of your download. Use your operating system’s checksum tool or a trusted hash utility.
Compare the two values. They must match exactly, character for character.
Act on the result. If they match, the file is verified. If they do not, delete the download and get a fresh copy from the official source.

This check protects you against corrupted downloads and against files that were altered in transit. It only works if you get the published hash from a trustworthy source, such as the official website. A hash copied from the same untrusted page as the download proves very little, because an attacker who replaced the file could also replace the hash.

Passwords: Never Use a Plain Hash

This is the most important section of this post. Neither MD5 nor SHA-256 should be used on its own to store passwords. A plain hash of a password is vulnerable to several attacks. Attackers can precompute hashes of common passwords in tables called rainbow tables, and then look up a stolen hash to find the password. They can also guess passwords at high speed, because hash functions are designed to be fast. Salting and slow, purpose-built password hashing are the defences.

For passwords, use a dedicated password-hashing function such as bcrypt or Argon2. These functions are deliberately slow, they include a salt automatically, and they are designed to make guessing expensive. A salt is a random value added to each password before hashing, so that two users with the same password end up with different hashes, and precomputed tables become useless. Bcrypt and Argon2 handle this for you when used correctly, which is one reason they are preferred over a hand-built scheme.

Never store passwords in plain text. Anyone who gains access to the database gains every password.
Never store a plain MD5 or SHA-256 of a password. Fast hashes make guessing cheap.
Use bcrypt or Argon2 for passwords. They are slow, salted, and designed for this job.
Do not invent your own password scheme. Use a well-tested library and follow its guidance.
Encourage strong, unique passwords. Even the best hashing cannot save a password like 123456 if it is guessed quickly.

The same warning applies to other sensitive values that behave like passwords, such as API keys and tokens. Hashing is one part of a security design, not a substitute for the whole design. If you are building a system that handles passwords, follow current guidance from a trusted source and have the design reviewed if the stakes are high.

Which Hash Should You Use?

For most decisions, the answer is simple. If you are choosing between MD5 and SHA-256, choose SHA-256. Use SHA-256 to verify downloads, to fingerprint content, and anywhere you need a general-purpose hash. Do not use MD5 for anything where an attacker could benefit from a collision. For passwords, use neither on its own. Use bcrypt or Argon2, or the password-hashing facility provided by your platform.

There are cases where the answer is more nuanced. Some old systems still produce MD5 hashes, and you may need to verify a legacy checksum that was published years ago. In that case, an MD5 match tells you something, but it does not prove what a SHA-256 match would prove. Treat it as a weak check, and migrate to SHA-256 when you can. Similarly, some protocols and standards specify a particular hash for compatibility. Follow the standard, but be aware of its limits and prefer modern options when the standard allows them.

Limitations

Hashes are powerful, but they have limits. A hash tells you whether data changed. It does not tell you who changed it, or whether the original data was trustworthy. A matching SHA-256 hash is only as reliable as the source of the published hash. A hash also does not encrypt anything. Hashing a secret does not hide it the way encryption does, and a hash cannot be reversed to recover the original data. Finally, security advice changes over time. SHA-256 is trusted today, but the right choice in a few years may be different, so check current guidance when you build a new system.

A hash detects change, but does not prove who made the original.
A checksum is only as trustworthy as the source that published it.
Hashing is not encryption, and a hash cannot be decrypted.
Fast hashes are the wrong tool for password storage.
Security recommendations evolve, so recheck guidance for new systems.

Frequently Asked Questions

Is MD5 completely useless?

No, but its uses are narrow. MD5 can still serve as a simple checksum where the only concern is accidental corruption, not a deliberate attacker. For anything security-related, including signatures, certificates, and password storage, MD5 should not be used. When in doubt, use SHA-256 instead.

Can I convert an MD5 hash into a SHA-256 hash?

No. Hashes are one-way, so you cannot recover the original input from an MD5 hash and rehash it. To get a SHA-256 hash, you need the original data and must compute the SHA-256 hash from it. If you only have the MD5 value, you cannot derive the SHA-256 value from it.

Why are plain hashes bad for passwords?

Plain hashes are fast, and speed helps an attacker who is guessing passwords. Attackers can also use precomputed tables of common passwords and their hashes. Dedicated password functions such as bcrypt and Argon2 are deliberately slow and include a salt, which makes guessing far more expensive. That is why they are the right tool for password storage.

How do I check a SHA-256 checksum?

Get the published SHA-256 hash from the official download page, compute the SHA-256 hash of the file you downloaded with your operating system’s checksum tool, and compare the two values character by character. If they match exactly, the file is verified. If they differ, delete the download and fetch a fresh copy from the official source.

MD5 and SHA-256 look similar on the surface, but they are not equals. MD5 is a 32-character hash that is broken for security purposes. SHA-256 is a 64-character hash that remains trusted for verification and modern security work. Choose SHA-256 between the two, and reach for bcrypt or Argon2 when passwords are involved. That simple rule will keep most of your hashing decisions on safe ground.