Hash Functions Compared: MD5, SHA-1, SHA-256, SHA-512

Cryptographic hash functions are the unsung workhorses of modern computing. They verify file integrity, anchor blockchains, secure TLS connections, and power password storage. Four hash functions cover most practical use cases: MD5, SHA-1, SHA-256, and SHA-512. Each has a distinct profile of speed, security, and size that determines where it's appropriate.

What a hash function does

A hash function takes an arbitrary-length input and produces a fixed-length output called a digest. The same input always produces the same output. Different inputs (in practice) produce different outputs. The output is irreversible — you can't recover the input from the digest.

For cryptographic use, three additional properties matter:

1. Pre-image resistance: Given a digest, it's infeasible to find an input that produces it.
2. Second pre-image resistance: Given an input, it's infeasible to find a different input that produces the same digest.
3. Collision resistance: It's infeasible to find any two inputs that produce the same digest.

When a hash function is "broken," it usually means collision resistance has been compromised — researchers found a way to construct two inputs that produce the same digest faster than brute force.

MD5: 128 bits, "broken" but still useful

MD5 produces a 128-bit (16-byte, 32-hex-character) digest. It was designed in 1991 by Ronald Rivest (the R in RSA). It's fast — faster than SHA-1, SHA-256, or SHA-512 — which made it popular for file integrity checks in the 1990s.

Collision status: Broken in 2004. Researchers found a way to construct two different inputs that produce the same MD5 digest in seconds. This means MD5 cannot be used for digital signatures, certificates, or any security-critical application where an attacker could craft a malicious input that matches a benign one.

What MD5 is still good for:

• Non-security checksums. File deduplication, cache keys, change detection. If you just need a quick fingerprint of a file or string and you trust the source, MD5 is fine. It's small (32 hex chars) and fast.
• Legacy systems. Many older protocols (HTTP Digest Auth, some SMTP implementations) still use MD5. You can't change the protocol; you have to live with it.
• Content-addressable storage. Git uses SHA-1, but some systems use MD5 for content addressing where collision resistance isn't critical because the attacker doesn't control the inputs.

What MD5 is NOT good for:

• Password storage. Use bcrypt, scrypt, or Argon2.
• Digital signatures. Use SHA-256 or SHA-512.
• TLS certificates. Banned since 2014.
• Any application where an attacker could craft a malicious input.

The browser's native Web Crypto API doesn't include MD5 (because it's broken). To compute MD5 in JavaScript, you need a pure-JavaScript implementation, which TextOpal's Hash Generator includes alongside the Web Crypto-based SHA functions.

SHA-1: 160 bits, also broken

SHA-1 produces a 160-bit (20-byte, 40-hex-character) digest. It was designed by the NSA in 1995 as a successor to SHA-0. It was the standard for digital signatures until the 2010s.

Collision status: Broken in 2017. Google and CWI Amsterdam demonstrated a practical collision ("SHAttered") with two PDF files that produce the same SHA-1 digest. Since then, browsers, CAs, and major systems have phased out SHA-1.

What SHA-1 is still good for:

• Git objects. Git uses SHA-1 for content addressing. The collision attack against SHA-1 requires crafted inputs, which is harder in Git's append-only model. Git is migrating to SHA-256, but SHA-1 remains the default.
• Legacy systems. Some old protocols still use SHA-1. You can't change them.

What SHA-1 is NOT good for:

• New digital signatures. Use SHA-256.
• New certificate authorities. Use SHA-256.
• New applications. There's no reason to use SHA-1 in 2026.

SHA-256: 256 bits, the modern default

SHA-256 produces a 256-bit (32-byte, 64-hex-character) digest. It's part of the SHA-2 family, designed by the NSA and published in 2001. It's the modern default for cryptographic hashing.

Collision status: Not broken. No practical collision attack is known. SHA-256 is considered secure for the foreseeable future.

What SHA-256 is good for:

• Digital signatures (X.509 certificates, code signing).
• TLS (used for handshake integrity and certificate signatures).
• Cryptocurrency (Bitcoin uses SHA-256 for proof-of-work).
• File integrity for security-critical applications.
• HMAC (Hash-based Message Authentication Codes).
• Blockchain applications.

Performance: Slower than MD5 and SHA-1, but fast enough for most uses. The Web Crypto API computes SHA-256 in milliseconds for inputs up to a few megabytes.

Recommendation: Use SHA-256 for any new application that requires cryptographic hashing. It's the modern default for a reason.

SHA-512: 512 bits, the larger sibling

SHA-512 produces a 512-bit (64-byte, 128-hex-character) digest. It's also part of the SHA-2 family, designed for applications that need more security margin or longer digests.

Collision status: Not broken. Same security level as SHA-256 in practice.

Performance: Counterintuitively, SHA-512 can be faster than SHA-256 on 64-bit platforms. The algorithm uses 64-bit words, which fit natively in 64-bit registers. On 32-bit platforms, SHA-256 is faster.

What SHA-512 is good for:

• Password hashing (combined with a salt and iteration count — but bcrypt or Argon2 are better).
• Applications that benefit from longer digests (some blockchain implementations).
• When you want maximum security margin and don't care about digest length.

Recommendation: Use SHA-512 when you need a longer digest or want extra security margin. For most applications, SHA-256 is sufficient.

SHA-3 and BLAKE3

SHA-3 (Keccak) and BLAKE3 are newer hash functions that haven't seen widespread adoption yet. SHA-3 was standardized by NIST in 2015 as a backup in case SHA-2 was broken (which it hasn't been). BLAKE3 is a 2020 design that's significantly faster than SHA-2 on modern hardware.

For most use cases, SHA-256 remains the right choice. SHA-3 and BLAKE3 are worth knowing about but not necessary for everyday work.

When to use which

For most developers, the decision tree is simple:

1. Security-critical application? Use SHA-256 (or SHA-512 if you need a longer digest).
2. Non-security checksum, small digest preferred? Use MD5 (with the caveat that it's broken).
3. Legacy system that requires a specific hash? Use whatever the system requires.
4. Password storage? Use bcrypt, scrypt, or Argon2 — never raw MD5, SHA-1, or SHA-256.

The hash you can compute locally

Whenever you compute a hash, the input stays on your device. There's no reason to send your text or files to a server for hashing — the algorithm runs in milliseconds in your browser.

TextOpal's Hash Generator supports MD5 (via a pure-JavaScript implementation), SHA-1, SHA-256, and SHA-512 (via the Web Crypto API). Switch between algorithms instantly, hash text or files (up to 50 MB), and compare expected hashes with a verify field. Everything runs locally — your data never leaves the browser.

The bottom line

MD5 and SHA-1 are "broken" in the cryptographic sense — collisions can be constructed — but they're still useful for non-security applications. SHA-256 is the modern default for cryptographic use. SHA-512 is the larger sibling for when you need more security margin or longer digests.

Pick the right tool for the job. Don't use MD5 for passwords. Don't use SHA-256 where you need a small digest. Don't use SHA-512 where speed matters more than security margin. The "right" hash function depends on what you're protecting and what you're protecting it against.