The Developer's Guide to Cryptographic Hashes: MD5, SHA-1, and SHA-256

Cryptographic hashes are fundamental to digital security, password storage, and data integrity. They are one-way functions that take an input (or “message”) and return a fixed-size string of bytes. The output is typically a hexadecimal number that uniquely represents the input. But with so many algorithms available, which one should you use in 2026?

How Hash Functions Work

A cryptographic hash function has five key properties:

1. Deterministic: The same input always produces the same output.
2. Fast computation: The hash should be quick to compute for any input.
3. Preimage resistance: Given a hash, it should be infeasible to reverse-engineer the original input.
4. Small changes, big differences: Changing one character in the input should produce a completely different hash (the avalanche effect).
5. Collision resistance: It should be infeasible to find two different inputs that produce the same hash.

MD5 and SHA-1: Legacy Algorithms

MD5 (Message Digest 5)

MD5 produces a 128-bit (32-character hexadecimal) hash. Released in 1992, it was once the most widely used hash function. However, by 2004, researchers had demonstrated practical collision attacks against MD5. Today, MD5 is considered cryptographically broken.

When MD5 is still acceptable:

• Non-security checksums (e.g., verifying a file download is not corrupted)
• Legacy system compatibility
• Non-critical indexing or deduplication

When MD5 should NEVER be used:

• Password hashing or storage
• Digital signatures
• SSL/TLS certificates
• Any security-critical application

SHA-1 (Secure Hash Algorithm 1)

SHA-1 produces a 160-bit (40-character hexadecimal) hash. It was the standard for SSL certificates and digital signatures for decades. However, in 2017, Google and CWI Amsterdam demonstrated the first practical SHA-1 collision attack (SHAttered). Since then, SHA-1 has been deprecated by all major browsers and certificate authorities.

Current status: SHA-1 is still found in legacy systems and Git uses it for commit hashing, but it is no longer considered secure against well-funded attackers.

SHA-256: The Modern Standard

SHA-256 (part of the SHA-2 family) produces a 256-bit (64-character hexadecimal) hash. It is currently considered secure and is widely used in:

• SSL/TLS certificates (alongside ECDSA signatures)
• Blockchain technology (Bitcoin uses double SHA-256)
• Secure data verification (checksums for software downloads)
• Digital signatures (part of the ECDSA and RSA signature algorithms)
• Password hashing (as part of HMAC or when iterated)

SHA-256 is not susceptible to any known practical collision attacks as of 2026. For most applications, it is the recommended general-purpose hash function.

SHA-3 and Beyond

SHA-3 is the latest member of the Secure Hash Algorithm family, released by NIST in 2015. While SHA-3 is not yet as widely adopted as SHA-2, it offers a different internal structure (Keccak sponge construction) that provides an additional layer of security margin. It is an excellent choice for new systems that want to be future-proof.

Password Hashing vs. General Hashing

A critical distinction developers must understand: SHA-256 is NOT suitable for password storage. Password hashing requires algorithms that are deliberately slow to brute-force. Use these instead:

• bcrypt: The most widely used, with configurable cost factor
• Argon2: The winner of the 2015 Password Hashing Competition; consider it the gold standard
• scrypt: Memory-hard algorithm that resists GPU and ASIC attacks

Why Local Hash Generation Matters

When generating hashes for sensitive strings, you should avoid online tools that might log your inputs. Even if a website claims to be secure, you have no visibility into what happens server-side. A developer hashing an API secret or a database password on a random website is taking an unnecessary risk.

The solution is to generate hashes locally using the Web Crypto API, which is built into every modern browser. The crypto.subtle.digest() function provides hardware-accelerated SHA-1, SHA-256, SHA-384, and SHA-512 hashing without any network calls.

Try our Local Hash Generator to instantly generate SHA-256 and SHA-512 hashes directly in your browser. Your input never leaves your device.

Quick Reference

The Bottom Line

Always use SHA-256 or SHA-512 for general hashing needs. Never use MD5 or SHA-1 for security-critical applications. For password storage, use bcrypt or Argon2. And always generate hashes locally to avoid exposing your inputs to third-party servers.