{# canonical_base is the OWNING tenant's origin: all 16 Peasy domains serve the same catalogue, so a page rendered by a non-owner points its canonical at the owner instead of competing with it. Falls back to this site for static/self-owned pages. #}
🍋
Menu
Comparison Beginner 1 min read 280 words

Text Hashing Explained: MD5, SHA-256, and When to Use Each

Compare cryptographic and non-cryptographic hash functions. Understand when MD5 is acceptable, when SHA-256 is necessary, and why hash functions are not encryption.

Key Takeaways

  • Hash functions are one-way transformations — they convert input of any size into a fixed-size output (digest).
  • MD5 is cryptographically broken — collisions can be constructed in seconds.
  • SHA-256 provides 128-bit collision resistance — finding two inputs with the same hash requires approximately 2^128 operations.
  • Never use SHA-256 or MD5 directly for password storage.
  • ## Password Hashing Is Different Never use SHA-256 or MD5 directly for password storage.

Hashing Is Not Encryption

Hash functions are one-way transformations — they convert input of any size into a fixed-size output (digest). Unlike encryption, hashing is irreversible by design. You cannot recover the original data from a hash. This makes hashing ideal for integrity verification, password storage, and deduplication.

Algorithm Comparison

Algorithm Output Size Speed Security Use Case
MD5 128 bits Very fast Broken Checksums, dedup (non-security)
SHA-1 160 bits Fast Broken Legacy systems only
SHA-256 256 bits Medium Strong File integrity, certificates
SHA-3 256+ bits Medium Strong Future-proof applications
BLAKE3 256 bits Very fast Strong High-performance hashing
xxHash 64/128 bits Extreme Non-crypto Hash tables, caching

MD5: Still Useful, Not for Security

MD5 is cryptographically broken — collisions can be constructed in seconds. However, it remains useful for non-adversarial checksums: verifying file downloads, detecting accidental corruption, and content-based deduplication where deliberate collision attacks are not a concern.

SHA-256: The Standard Choice

SHA-256 provides 128-bit collision resistance — finding two inputs with the same hash requires approximately 2^128 operations. It is the standard for digital signatures, certificate chains, and any context where an attacker might try to create hash collisions.

Password Hashing Is Different

Never use SHA-256 or MD5 directly for password storage. Use dedicated password hashing functions (bcrypt, scrypt, Argon2) that are intentionally slow and include salt values to prevent rainbow table attacks.