SHA-256 vs MD5: Which Hash Algorithm Should You Use?

Hash functions are everywhere in software development — from password storage to file integrity verification. But not all hash algorithms are equal. Understanding the difference between SHA-256 and MD5 can protect your users from security vulnerabilities.

What is a Hash Function?

A hash function takes any input and produces a fixed-length output (the hash). The same input always produces the same hash, but you cannot reverse the hash to get the original input.

// JavaScript example
const crypto = require("crypto");

const md5 = crypto.createHash("md5").update("hello").digest("hex");
// → 5d41402abc4b2a76b9719d911017c592

const sha256 = crypto.createHash("sha256").update("hello").digest("hex");
// → 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

MD5 — Fast but Broken

• Produces a 128-bit (32 hex character) hash
• Very fast to compute
• Collision vulnerable — Two different inputs can produce the same hash
• Broken for security purposes since 2004
• Still useful for non-security checksums (file integrity where attack is not a concern)

SHA-256 — The Modern Standard

• Produces a 256-bit (64 hex character) hash
• Part of the SHA-2 family designed by the NSA
• No known collisions
• Used in Bitcoin, TLS certificates, code signing
• Slightly slower than MD5 but fast enough for almost all use cases

When to Use Each

Never use MD5 or SHA-1 for password hashing. Use bcrypt, Argon2, or PBKDF2 instead — they are designed to be slow, which makes brute-force attacks impractical.

Use MD5 for:

• File deduplication (where security is not a concern)
• Cache keys and non-security checksums
• Legacy system compatibility

Use SHA-256 for:

• Digital signatures and certificates
• Data integrity verification
• API request signing (HMAC-SHA256)
• Blockchain and cryptocurrency
• Fingerprinting documents

Kotlin Example — File Hashing

import java.security.MessageDigest
import java.io.File

fun hashFile(file: File, algorithm: String = "SHA-256"): String {
    val digest = MessageDigest.getInstance(algorithm)
    file.forEachBlock { buffer, bytesRead ->
        digest.update(buffer, 0, bytesRead)
    }
    return digest.digest().joinToString("") { "%02x".format(it) }
}

// Usage
val hash = hashFile(File("document.pdf"), "SHA-256")
println("SHA-256: $hash")