Collision-broken does not mean reversible: an attacker can craft two different inputs with the same digest, which is fatal for signatures and certificates, not for spotting a truncated download. SHA-1 and MD5 remain fine for detecting accidental corruption. The Hash Generator computes all three locally in your browser.
The three at a glance
digest hex chars collision resistance MD5 128 bit 32 broken (2004) SHA-1 160 bit 40 broken (SHAttered, 2017) SHA-256 256 bit 64 no known practical attack
Digest length is the quickest identification trick: d41d8cd9… at 32 characters is MD5, 40 is SHA-1, 64 is SHA-256. Try it, hash the same text with SHA-256 and MD5 and compare. The empty string has famous, recognizable digests you will meet in logs and tests:
MD5("") = d41d8cd98f00b204e9800998ecf8427e
SHA-1("") = da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA-256("") = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855Seeing one of these where a real checksum should be means something hashed nothing, an empty file, a failed read, a variable that was never set. Worth memorizing at least the d41d8 and e3b0c prefixes. And hashes have no “close”: changing one bit flips about half the output bits (the avalanche effect), SHA-256("hello") starts 2cf24dba… while SHA-256("Hello") starts 185f8db3…, sharing nothing.
What “broken” means, and what it doesn't
A collision attack lets someone construct two inputs with the same digest. Google's SHAttered attack produced two different PDFs with an identical SHA-1 hash; MD5 collisions compute in seconds on a laptop. Crucially, this breaks scenarios where an attacker controls the inputs, forged certificates, tampered signed documents, poisoned dedup stores. It does not let anyone find an input matching your existing file's hash (a second-preimage attack, still impractical even for MD5). Hence the honest split: broken against adversaries, fine against accidents.
What the attacks cost
Numbers make the difference between the two “broken” algorithms concrete. An MD5 collision computes in under a second on ordinary hardware. It has been a classroom exercise for years, and chosen-prefix variants (two meaningful colliding documents) are cheap enough for hobbyists. SHAttered's SHA-1 collision took about 263 hash computations (Google quoted roughly 6,500 CPU-years plus 110 GPU-years, run in parallel) and the follow-up chosen-prefix attack in 2020 cost on the order of tens of thousands of dollars in rented GPUs. Expensive for you and me; pocket change for a state or a well-funded crime group, and costs only fall. SHA-256's best public cryptanalysis, by contrast, dents reduced-round variants only: there is no known collision, and 2128 birthday work is far beyond any conceivable hardware.
The HMAC footnote
One nuance that surprises people: HMAC-SHA1 and even HMAC-MD5 are not broken by collision attacks, the HMAC construction does not rely on collision resistance, so systems verifying HMAC-SHA1 signatures are not urgently on fire. That is an argument for orderly migration rather than panic, not for choosing them in new designs: new code should use HMAC-SHA256, which Web Crypto also provides.
Where each is still legitimate
- SHA-256: download verification, content addressing, signatures and certificates (as part of proper schemes), integrity checks, cache keys, deduplication. Default to it. Browsers implement it natively via
crypto.subtle.digest. - SHA-1: matching existing checksums in older systems and protocols. Git's object IDs remain the famous example.
- MD5: legacy checksum files (
.md5), ETag schemes, non-adversarial dedupe. Web Crypto deliberately omits it, a small honest signal of its status.
What none of them are for
Passwords. A fast hash (and all three are designed to be fast) is exactly wrong for password storage, where you want each guess to be expensive. Use Argon2, scrypt or bcrypt with a salt. And no hash provides secrecy at all: hashing is one-way fingerprinting, not encryption, and short or guessable inputs are recoverable from lookup tables regardless of algorithm. For encoding (not protecting) data in transit, that job belongs to Base64, which protects nothing either, but at least says so.