MD5 vs SHA-256: What's the Difference and Which Should You Use?

MD5 and SHA-256 are both hash functions — they take any input and produce a fixed-length string (a "digest") that acts like a fingerprint of that data. Same input always produces the same output, and even a tiny change to the input produces a completely different digest. Where they differ is how safe that fingerprint actually is to rely on.

What a hash function is actually for

Hashing solves two different problems depending on context: verifying that data hasn't changed (integrity checking — did this file download correctly, is this exactly the file I think it is), and cryptographic security (can someone deliberately craft different input that produces the same hash, and can they exploit that). MD5 and SHA-256 both handle the first job fine. Only SHA-256 is trustworthy for the second.

Why MD5 is considered broken

MD5 produces a 128-bit digest and was designed in 1991. Its core security property — that finding two different inputs producing the same hash (a "collision") should be computationally infeasible — was broken in practice years ago. Researchers can now generate MD5 collisions cheaply, which means MD5 can't be trusted anywhere an attacker might deliberately try to fake a match: digital signatures, certificate validation, or anything where you need a real security guarantee.

Why SHA-256 is the modern standard

SHA-256 produces a 256-bit digest and is part of the SHA-2 family, which remains free of any practical collision attack. It's what's actually used under the hood for TLS certificates, Bitcoin's proof-of-work, Git's newer object hashing, and most security-sensitive checksums today. It's slower to compute than MD5, but that's a non-issue for virtually every real use case and is actually a small plus, not a downside, in security contexts.

So which should you actually use

• Verifying a downloaded file matches what the publisher intended (a checksum posted alongside a download) — SHA-256, since you want a real guarantee nobody tampered with it in transit.
• Quick internal deduplication or change-detection where nobody is trying to attack you (e.g., "has this internal config file changed since last time") — MD5 is still fine and marginally faster, though there's rarely a real reason not to just use SHA-256 everywhere and stop thinking about it.
• Anything security-sensitive — digital signatures, certificate fingerprints, integrity checks on anything security-relevant — always SHA-256 or newer, never MD5.