MD5 Is Broken But You're Still Using It: Hash Functions Explained for 2026
The no-nonsense guide to cryptographic hash functions — why MD5 was broken in 2004 and Flame malware weaponized it in 2012, how SHA-256 and SHA-512 compare, what salting does, and which algorithm to choose for every real-world use case.
Three months into my first backend job, I found this in the codebase: MD5(user.password). The senior developer who wrote it had left the company. When I flagged it, the response was 'it's hashed though, isn't that fine?' That question sent me down a rabbit hole that changed how I think about security fundamentals. No, it's not fine. And the reason why is one of the most interesting stories in the history of applied cryptography.
This guide covers what hash functions actually do, why MD5 collapsed as a security tool (with a specific timeline), how SHA-256 and SHA-512 differ, and what salting is and why you need it. By the end, you'll be able to answer 'which hash should I use?' for any situation — and explain why to whoever is still reaching for MD5.
What you'll learn in this guide
- ✅A full algorithm comparison table: MD5, SHA-1, SHA-256, SHA-512 — output size, speed, and current security status
- ✅The exact timeline of how MD5 went from standard to actively exploited, including the Flame malware incident
- ✅What password salting is, why it matters, and which modern algorithms handle it automatically
What a Hash Function Actually Does
A hash function takes any input — a single character, a 10 GB file, an entire novel — and produces a fixed-length output called a hash, digest, or checksum. The output size depends on the algorithm: MD5 always produces 128 bits (32 hex characters), SHA-256 always produces 256 bits (64 hex characters), regardless of input size.
- Deterministic: The same input always produces the same hash. 'hello' hashes to the same value on any machine, any time.
- One-way: Given a hash value, you cannot mathematically reverse-engineer the original input. There is no 'undo' button.
- Avalanche effect: Change a single character in the input and the output changes completely — not slightly. 'hello' and 'helli' produce entirely different hashes.
- Fixed-length output: No matter how long the input, the output is always the same size. A 1-byte file and a 1 GB file produce the same-length hash.
- Collision-resistant: It should be computationally infeasible to find two different inputs that produce the same hash output.
Hash vs. Encryption: a critical difference
Hashing is one-way — you cannot decrypt a hash back to its original value. Encryption is two-way — with the right key, you can recover the original data. Storing hashed passwords is correct precisely because you cannot reverse it. Storing encrypted passwords means someone who steals your encryption key can decrypt every password in your database.
Try this tool now:
Try the Hash Generator →Algorithm Comparison: MD5, SHA-1, SHA-256, SHA-512
| Algorithm | Output size | Speed | Security status | Use today? |
|---|---|---|---|---|
| MD5 | 128 bits (32 hex) | Very fast | BROKEN — collisions in seconds | No (non-security only) |
| SHA-1 | 160 bits (40 hex) | Fast | DEPRECATED — practical collision (2017) | No (legacy only) |
| SHA-256 | 256 bits (64 hex) | Moderate | Strong — no known attacks | Yes (default choice) |
| SHA-512 | 512 bits (128 hex) | Fast on 64-bit | Strong — larger security margin | Yes (high-security) |
The MD5 Collapse Timeline: How a Standard Became a Weapon
MD5 was designed in 1992 by Ronald Rivest and was the dominant hashing algorithm for over a decade. Then, over roughly eight years, it went from ubiquitous standard to active exploit vector.
MD5 Security Collapse Timeline
MD5 is not safe for passwords, certificates, or signatures
Collisions mean an attacker can craft a malicious input that produces the same MD5 hash as a legitimate one — which breaks digital signatures and certificate verification. For password storage, MD5 is also catastrophically fast: a GPU cluster can test billions of MD5 hashes per second, making brute-force attacks trivial. If you find MD5 in a password system, treat it as a critical security incident.
SHA-256 vs SHA-512: Which Should You Use?
Both SHA-256 and SHA-512 are members of the SHA-2 family, designed by the NSA and published by NIST in 2001. Both are secure. The differences are practical, not security-critical.
- SHA-256: The standard default for 2026. Supported everywhere — TLS certificates, JWT signatures, Git commit hashes, Bitcoin mining. If you're not sure which to use, SHA-256 is the answer.
- SHA-512: Better for 64-bit systems. SHA-512 uses 64-bit operations internally, making it actually faster than SHA-256 on 64-bit hardware. Use it when you want a larger security margin or when your platform benefits from 64-bit operations.
- SHA-512/256: A truncated SHA-512 that produces 256-bit output but uses SHA-512 internals. Gets 64-bit speed with 256-bit output size. Rarely used but worth knowing about.
- SHA-3: A completely different design (not SHA-2). Designed as a backup in case SHA-2 is ever broken. Not required for new projects in 2026, but useful for high-assurance systems that want algorithm diversity.
Password Hashing: Why MD5 and Even SHA-256 Are Wrong
Here's a fact that surprises many developers: SHA-256 is also wrong for password storage, even though it's secure. The issue is speed. SHA-256 is designed to be fast — ideal for file integrity checks, but terrible for passwords, because an attacker can test billions of SHA-256 hashes per second.
For passwords, you want a deliberately slow algorithm. The options are bcrypt, scrypt, and Argon2. These are designed to be computationally expensive — you can tune how slow they are, trading security for user-perceived login speed.
- bcrypt: The classic choice. Widely supported. Has a 72-character input limit (truncates longer passwords) — a known limitation. Work factor configurable.
- scrypt: Adds memory hardness — requires a lot of RAM, not just CPU. Harder to attack with GPU clusters. Used in some cryptocurrency systems.
- Argon2: Winner of the 2015 Password Hashing Competition. The current best practice. Configurable in CPU time, memory, and parallelism. Use Argon2id (the hybrid variant) for new systems.
What Salting Does (and Why Rainbow Tables Are Already Dead)
A rainbow table is a precomputed lookup table mapping common passwords to their hashes. Without salting, an attacker who breaches your database can look up 'abc123' → MD5 hash and instantly know which users have that password. Salting defeats this by adding random data to each password before hashing.
How salting works
Modern password hashing algorithms (bcrypt, Argon2) generate and store the salt automatically — it's embedded in the output string. You do not need to manage salts manually when using these libraries.
Practical Use Cases for Hash Functions
- File integrity verification: Download a file and compare its SHA-256 hash with the published checksum. If they match, the file was not tampered with in transit. Linux ISOs and major software packages routinely publish SHA-256 checksums.
- Password storage: Hash passwords with Argon2id (never store plaintext). Even if your database is breached, attackers cannot reverse the hashes to get passwords.
- Digital signatures: Sign a document by hashing it (SHA-256) and encrypting the hash with your private key. The recipient hashes the document too, decrypts your signature, and compares.
- Content addressing: Systems like Git, IPFS, and content delivery networks use hashes to identify content by what it is, not where it lives. If the hash matches, the content is identical.
- Data deduplication: Hash files to find duplicates without comparing their full contents. If two files have the same SHA-256 hash, they are identical.
- Message authentication (HMAC): Combine a hash with a secret key to verify both content integrity and authenticity. Used in JWT tokens, API authentication, and webhook signatures.
Try this tool now:
Generate and Compare Hashes →Frequently Asked Questions
Can two different files have the same hash?
Theoretically yes — this is called a collision. For SHA-256, the probability of any accidental collision is approximately 1 in 2^128, which is astronomically small. For MD5, collisions can be engineered intentionally in seconds. For practical purposes: if two files share a SHA-256 hash, they are identical. If they share an MD5 hash, they might be identical — or someone might have crafted an attack.
Is hashing the same as encryption?
No — they are fundamentally different. Hashing is one-way: given a hash, you cannot recover the original input. Encryption is two-way: with the right key, you can decrypt back to the original. Use hashing when you want to verify something (passwords, file integrity). Use encryption when you need to recover the original data (storing sensitive but retrievable information).
What algorithm should I use for passwords in 2026?
Argon2id is the current best practice for new systems. It won the 2015 Password Hashing Competition and is configurable for CPU time, memory, and parallelism. For existing systems using bcrypt, bcrypt is still secure — no need to migrate urgently. Never use MD5, SHA-1, or plain SHA-256 for passwords.
What is HMAC and when should I use it?
HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce a message authentication code. It verifies both that the message has not been tampered with AND that the sender knows the secret key. Use HMAC for: API authentication (verify request signatures), JWT signatures (HS256 = HMAC with SHA-256), webhook verification (confirm requests came from the legitimate sender).
Why is SHA-256 faster than SHA-512 on some systems?
SHA-512 uses 64-bit words internally and is optimized for 64-bit processors. On a 64-bit machine, SHA-512 can actually be faster than SHA-256 because modern CPUs handle 64-bit operations efficiently. On 32-bit systems (embedded devices, older hardware), SHA-512 is slower because 64-bit operations require multiple 32-bit instructions.
Is SHA-256 quantum-resistant?
SHA-256 provides 128 bits of security against quantum attacks (Grover's algorithm halves the effective key length). For most purposes, 128-bit quantum security is sufficient. SHA-512 provides 256 bits of quantum security. If you are designing systems that need to be secure for decades against future quantum computers, SHA-512 or SHA-3 provides a larger margin.
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from any text — instantly, in your browser, with no data sent to servers
Open Hash Generator →▶Try the tools from this article
Minjae
Developer & tech writer. Deep dives into dev tools and file conversion technology.
Found this helpful? Get new guide alerts
No spam. Unsubscribe anytime. · By subscribing, you agree to our Privacy Policy.