MD5, SHA-1, SHA-256, bcrypt — what's the difference and when should you use each? A plain-English guide to hashing algorithms and password security.
MD5, SHA-1, SHA-256, bcrypt — if you've worked with passwords, user authentication, or file verification, you've encountered these names. They're all hashing algorithms, but they serve very different purposes and carry very different levels of security. Choosing the wrong one for the wrong job is one of the most common security mistakes in web development.
This guide explains what each algorithm does, how they compare, and when you should use each one.
What Is a Hash Function?
A hash function takes an input of any size and produces a fixed-length output called a hash or digest. The process is one-way — you cannot mathematically reverse a hash to recover the original input. The same input always produces the same output, but any change to the input — even a single character — produces a completely different hash.
These properties make hash functions useful for:
- Verifying file integrity without storing the original file
- Storing passwords securely without saving the actual password
- Creating digital signatures and verifying document authenticity
- Detecting data tampering in transit
MD5: Fast, Convenient, and Broken for Security
MD5 (Message Digest 5) produces a 128-bit hash — displayed as a 32-character hexadecimal string. It was designed in 1991 and was once widely used for password hashing and file verification.
The problem: MD5 is cryptographically broken. Researchers have demonstrated practical collision attacks — meaning it's possible to deliberately create two different inputs that produce the same MD5 hash. Additionally, because MD5 is extremely fast to compute, modern GPUs can calculate billions of MD5 hashes per second, making brute force attacks highly practical.
When MD5 is still acceptable:
- Non-security checksums — verifying a file downloaded correctly (where attackers can't manipulate the source)
- Hash table indexing in applications where security isn't a concern
- Generating Gravatar URLs (which use MD5 of email addresses by design)
Never use MD5 for: password storage, digital signatures, security-critical integrity checks, or any context where an attacker could benefit from finding a collision.
SHA-1: Deprecated — Do Not Use for Security
SHA-1 (Secure Hash Algorithm 1) produces a 160-bit hash — a 40-character hex string. It was the successor to MD5 and was widely used in SSL certificates, code signing, and version control systems (Git still uses SHA-1 for commit hashing, though it's migrating away).
The problem: In 2017, Google's Project Zero team demonstrated the first practical SHA-1 collision attack (called SHAttered). Major browsers began rejecting SHA-1 certificates in 2017. SHA-1 is now considered deprecated for all security purposes.
When SHA-1 is still seen: Legacy systems, Git commit IDs (being phased out), and older software. It should never be used in new projects for anything security-related.
SHA-256: The Current Security Standard
SHA-256 (Secure Hash Algorithm 256-bit) is part of the SHA-2 family and produces a 256-bit hash — a 64-character hex string. It was designed by the NSA and standardized by NIST. Unlike MD5 and SHA-1, no practical attacks against SHA-256 have been demonstrated.
Where SHA-256 is used:
- SSL/TLS certificates — the default for all modern HTTPS connections
- Bitcoin and most cryptocurrency protocols (SHA-256 powers Bitcoin mining)
- File integrity verification — software publishers provide SHA-256 checksums for downloads
- Digital signatures and code signing
- HMAC-SHA256 for API authentication and webhook verification
- Git (transitioning to SHA-256 for object hashing)
Is SHA-256 good for password storage? It's secure against collision attacks, but raw SHA-256 is too fast for password hashing. An attacker can compute billions of SHA-256 hashes per second using a GPU, making dictionary and brute force attacks against stolen SHA-256 password hashes feasible. Use bcrypt instead (see below).
Generate SHA-256 Hashes Free →
SHA-512: More Security, Same Family
SHA-512 produces a 512-bit hash — a 128-character hex string. It's part of the same SHA-2 family as SHA-256 and uses the same underlying design, but with a longer output and more rounds of computation.
On 64-bit systems, SHA-512 is often faster than SHA-256 because it uses native 64-bit operations. Choose SHA-512 when you need a larger digest — for example, when hashing very large files or when the extra margin matters for long-term archive integrity.
Like SHA-256, raw SHA-512 is not suitable for password hashing due to its speed. Use bcrypt for passwords.
bcrypt: The Right Choice for Password Storage
bcrypt is a password hashing function specifically designed for storing passwords securely. Unlike SHA-256 and MD5 — which are designed to be as fast as possible — bcrypt is intentionally slow. This is its defining security feature.
How bcrypt works:
- Cost factor (work factor) — bcrypt accepts a configurable cost parameter that controls how much computation is required. Increasing the cost factor by 1 doubles the time to compute a hash. A cost of 10 means 2¹⁰ = 1,024 rounds of computation.
- Built-in salt — bcrypt automatically generates and includes a random salt in every hash. This means two identical passwords produce completely different hashes, defeating rainbow table attacks.
- Future-proof — As hardware gets faster, you can increase the cost factor to maintain the same level of security.
What bcrypt output looks like:
$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
The hash embeds the algorithm version ($2b$), the cost factor (10), and the salt — everything needed to verify the password later.
Quick Comparison: Which Algorithm Should You Use?
| Algorithm | Output Size | Speed | Security Status | Best For |
|---|---|---|---|---|
| MD5 | 128-bit (32 chars) | Very fast | Broken ❌ | Non-security checksums only |
| SHA-1 | 160-bit (40 chars) | Fast | Deprecated ❌ | Legacy systems only |
| SHA-256 | 256-bit (64 chars) | Fast | Secure ✅ | File integrity, digital signatures, APIs |
| SHA-512 | 512-bit (128 chars) | Fast (faster on 64-bit) | Secure ✅ | High-security file integrity, archives |
| bcrypt | 60 chars (fixed) | Intentionally slow | Secure ✅ | Password storage only |
Key Takeaways
- Never use MD5 or SHA-1 for anything security-related — they are broken
- Use SHA-256 or SHA-512 for file integrity, digital signatures, API authentication, and data verification
- Always use bcrypt (or Argon2) for storing passwords — never raw SHA hashes
- Never store plaintext passwords — always hash them before storing
- Add a salt to any raw hash used for sensitive data to prevent rainbow table attacks