MD5 vs SHA-256: Why MD5 Is Broken (and What to Use)

You inherit a codebase and find md5(password) in the login flow, or a download page that publishes MD5 checksums. Is that actually a problem, or just old-fashioned? It depends entirely on whether an attacker benefits from fooling the hash — and that distinction is the whole MD5 vs SHA-256 question.

What "broken" means here

MD5 (1992) and SHA-256 (2001) both turn any input into a fixed fingerprint — 32 hex characters for MD5, 64 for SHA-256. You can compare them side by side in the Hash Generator.

The difference is collision resistance. In 2004, researchers demonstrated two different inputs producing the same MD5 hash; today, crafting a colliding pair takes seconds on ordinary hardware. That's fatal for security: an attacker can prepare a harmless file and a malicious file with identical MD5 fingerprints, get the harmless one approved, then swap in the malicious one — and the checksum still matches. This isn't theoretical; the Flame malware used an MD5 collision to forge a Microsoft code-signing certificate in 2012.

No practical collision has ever been found for SHA-256. Its 256-bit space (~1.2 × 10^77 values) puts brute-forcing one beyond any foreseeable hardware.

Where MD5 is still fine

Broken for security doesn't mean useless. When no adversary is trying to trick you, MD5's speed is a legitimate feature:

• Detecting accidental corruption in a file transfer between your own systems.
• Deduplication and cache keys — spotting identical files or busting a cache.
• Partitioning or sharding data by hash bucket.

The test: if a deliberately crafted collision would hurt you, MD5 is out. If only random corruption matters, MD5 is fine — though SHA-256 costs little more and removes the judgment call.

Passwords: neither, actually

This surprises people: SHA-256 is also the wrong tool for storing passwords. Both MD5 and SHA-256 are designed to be fast, and fast is exactly what lets attackers test billions of guesses per second against a stolen database. Password storage needs a deliberately slow, salted algorithm — bcrypt, scrypt, or Argon2. And the passwords themselves should be strong to begin with; the Password Generator beats any scheme you'd invent.

Common mistakes

• "I'll just hash it twice." md5(md5(x)) inherits every weakness of MD5. Layering a broken function doesn't repair it.
• Treating a hash as encryption. Hashes are one-way and keyless; nothing is "locked" that can be unlocked. (And Base64 is neither — it's reversible encoding with zero secrecy.)
• Using a hash as a unique ID. For identifiers you need uniqueness, not integrity — a UUID is built for that.
• Comparing hashes by eye. a3f5... and a3f5... can differ at character 40. Paste both into the Hash Generator output field or use exact string comparison — never skim.