SHA-256 vs MD5: Cryptographic Hash Functions Explained for Developers

What is a Cryptographic Hash Function?

A cryptographic hash function takes an input of any size and produces a fixed-size output (the hash or digest) with three critical properties:

1. Deterministic: Same input always produces the same hash
2. One-way: Cannot reverse-engineer the input from the hash
3. Avalanche effect: A single character change produces a completely different hash

---

Common Hash Functions

---

Why MD5 is Broken

In 2004 researchers demonstrated practical collision attacks — finding two different inputs that produce the same MD5 hash.

Never use MD5 for:

• Password storage
• Digital signatures
• Certificate verification

MD5 is acceptable only for non-security checksums — verifying file transfer integrity where collision attacks are not a threat.

---

SHA-256 in Practice

// Node.js
const crypto = require('crypto');

const hash = crypto
  .createHash('sha256')
  .update('Hello, World!')
  .digest('hex');

// dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986d

---

Critical: Never Use SHA-256 for Passwords

SHA-256 is designed to be fast. A modern GPU can compute billions of SHA-256 hashes per second, making brute-force attacks trivially fast.

Use bcrypt or Argon2 for passwords — they are intentionally slow:

const bcrypt = require('bcryptjs');

// Hash a password (takes 100-300ms intentionally)
const hash = await bcrypt.hash('userPassword123!', 12);

// Verify
const match = await bcrypt.compare('userPassword123!', hash); // true

---

Hash Use Cases Map

---

Rainbow Tables and Salting

A rainbow table is a precomputed table of hash to password mappings. An attacker can look up any unsalted hash instantly.

bcrypt and Argon2 include automatic random salting — always use algorithms that handle this automatically.

---

Conclusion

Use SHA-256 for checksums and signatures. Use Argon2id or bcrypt exclusively for password storage. Avoid MD5 for anything security-related. Use our Hash Generator tool to instantly compute MD5, SHA-1, SHA-256, and SHA-512 hashes for any text.