MD5 vs SHA-256: What Hashing Actually Does and When You Need It

A hash function takes any input — a password, a file, a string — and produces a fixed-length string of characters that acts as a fingerprint. The same input always produces the same hash, but you can't reverse a hash back into the original input. That one-way property is what makes hashing useful for security and integrity checking, and also why choosing the right algorithm matters.

MD5

Fast and produces a short 128-bit hash, but it's cryptographically broken — researchers can deliberately construct two different inputs that produce the same MD5 hash (a "collision"). That makes MD5 unsafe for anything security-related, like storing passwords, but it's still fine for non-adversarial uses like checking whether a downloaded file got corrupted in transit.

SHA-1

Stronger than MD5 but also considered broken for security purposes since 2017, when researchers demonstrated a practical collision attack. Avoid it for new security-sensitive work; it mostly persists in older systems that haven't been updated.

SHA-256

Part of the SHA-2 family, produces a 256-bit hash, and has no known practical collision attacks. This is the current standard for security-sensitive hashing — file integrity verification, blockchain, and (combined with proper salting) password storage.

How to generate a hash

• Open the Hash Generator.
• Paste in your text.
• Get MD5, SHA-1, and SHA-256 hashes instantly, computed locally in your browser.

The simple rule

If it's security-related — passwords, tokens, anything an attacker might try to forge — use SHA-256 or stronger. If it's just a quick integrity check on a file you downloaded, MD5 is still a fine, fast checksum.