Text Hashing Explained: MD5, SHA-256, and When to Use Each
Compare cryptographic and non-cryptographic hash functions. Understand when MD5 is acceptable, when SHA-256 is necessary, and why hash functions are not encryption.
Key Takeaways
- Hash functions are one-way transformations — they convert input of any size into a fixed-size output (digest).
- MD5 is cryptographically broken — collisions can be constructed in seconds.
- SHA-256 provides 128-bit collision resistance — finding two inputs with the same hash requires approximately 2^128 operations.
- Never use SHA-256 or MD5 directly for password storage.
- ## Password Hashing Is Different Never use SHA-256 or MD5 directly for password storage.
Hash Generator
Generate SHA-1, SHA-256, SHA-384, SHA-512 hashes from text
Hashing Is Not Encryption
Hash functions are one-way transformations — they convert input of any size into a fixed-size output (digest). Unlike encryption, hashing is irreversible by design. You cannot recover the original data from a hash. This makes hashing ideal for integrity verification, password storage, and deduplication.
Algorithm Comparison
| Algorithm | Output Size | Speed | Security | Use Case |
|---|---|---|---|---|
| MD5 | 128 bits | Very fast | Broken | Checksums, dedup (non-security) |
| SHA-1 | 160 bits | Fast | Broken | Legacy systems only |
| SHA-256 | 256 bits | Medium | Strong | File integrity, certificates |
| SHA-3 | 256+ bits | Medium | Strong | Future-proof applications |
| BLAKE3 | 256 bits | Very fast | Strong | High-performance hashing |
| xxHash | 64/128 bits | Extreme | Non-crypto | Hash tables, caching |
MD5: Still Useful, Not for Security
MD5 is cryptographically broken — collisions can be constructed in seconds. However, it remains useful for non-adversarial checksums: verifying file downloads, detecting accidental corruption, and content-based deduplication where deliberate collision attacks are not a concern.
SHA-256: The Standard Choice
SHA-256 provides 128-bit collision resistance — finding two inputs with the same hash requires approximately 2^128 operations. It is the standard for digital signatures, certificate chains, and any context where an attacker might try to create hash collisions.
Password Hashing Is Different
Never use SHA-256 or MD5 directly for password storage. Use dedicated password hashing functions (bcrypt, scrypt, Argon2) that are intentionally slow and include salt values to prevent rainbow table attacks.