Use SHA-256 for anything where correctness matters against an adversary; use SHA-1 or MD5 only to interoperate with legacy checksums. Both older algorithms are broken for collision resistance — MD5 since 2004, SHA-1 demonstrably since 2017 — but remain fine for detecting accidental corruption. The Hash Generator computes all three locally in your browser.
The three at a glance
digest hex chars collision resistance MD5 128 bit 32 broken (2004) SHA-1 160 bit 40 broken (SHAttered, 2017) SHA-256 256 bit 64 no known practical attack
Digest length is the quickest identification trick: d41d8cd9… at 32 characters is MD5, 40 is SHA-1, 64 is SHA-256. Try it — hash the same text with SHA-256 and MD5 and compare. The empty string has famous, recognizable digests you will meet in logs and tests:
MD5("") = d41d8cd98f00b204e9800998ecf8427e
SHA-1("") = da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA-256("") = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855Seeing one of these where a real checksum should be means something hashed nothing — an empty file, a failed read, a variable that was never set. Worth memorizing at least the d41d8 and e3b0c prefixes. And hashes have no “close”: changing one bit flips about half the output bits (the avalanche effect) — SHA-256("hello") starts 2cf24dba… while SHA-256("Hello") starts 185f8db3…, sharing nothing.
What “broken” means — and what it doesn't
A collision attack lets someone construct two inputs with the same digest. Google's SHAttered attack produced two different PDFs with an identical SHA-1 hash; MD5 collisions compute in seconds on a laptop. Crucially, this breaks scenarios where an attacker controls the inputs — forged certificates, tampered signed documents, poisoned dedup stores. It does not let anyone find an input matching your existing file's hash (a second-preimage attack, still impractical even for MD5). Hence the honest split: broken against adversaries, fine against accidents.
What the attacks cost
Numbers make the difference between the two “broken” algorithms concrete. An MD5 collision computes in under a second on ordinary hardware — it has been a classroom exercise for years, and chosen-prefix variants (two meaningful colliding documents) are cheap enough for hobbyists. SHAttered's SHA-1 collision took about 263 hash computations — Google quoted roughly 6,500 CPU-years plus 110 GPU-years, run in parallel — and the follow-up chosen-prefix attack in 2020 cost on the order of tens of thousands of dollars in rented GPUs. Expensive for you and me; pocket change for a state or a well-funded crime group, and costs only fall. SHA-256's best public cryptanalysis, by contrast, dents reduced-round variants only — there is no known collision, and 2128 birthday work is far beyond any conceivable hardware.
The HMAC footnote
One nuance that surprises people: HMAC-SHA1 and even HMAC-MD5 are not broken by collision attacks — the HMAC construction does not rely on collision resistance, so systems verifying HMAC-SHA1 signatures are not urgently on fire. That is an argument for orderly migration rather than panic, not for choosing them in new designs: new code should use HMAC-SHA256, which Web Crypto also provides.
Where each is still legitimate
- SHA-256: download verification, content addressing, signatures and certificates (as part of proper schemes), integrity checks, cache keys, deduplication. Default to it. Browsers implement it natively via
crypto.subtle.digest. - SHA-1: matching existing checksums in older systems and protocols. Git's object IDs remain the famous example.
- MD5: legacy checksum files (
.md5), ETag schemes, non-adversarial dedupe. Web Crypto deliberately omits it — a small honest signal of its status.
What none of them are for
Passwords. A fast hash — and all three are designed to be fast — is exactly wrong for password storage, where you want each guess to be expensive. Use Argon2, scrypt or bcrypt with a salt. And no hash provides secrecy at all: hashing is one-way fingerprinting, not encryption, and short or guessable inputs are recoverable from lookup tables regardless of algorithm. For encoding (not protecting) data in transit, that job belongs to Base64 — which protects nothing either, but at least says so.