What a hash function does
A cryptographic hash function takes an input of any length and produces a fixed-length output (the digest or hash). Three properties define a secure hash function:
- Deterministic: the same input always produces the same hash.
- Pre-image resistant: given a hash, it is computationally infeasible to find the original input.
- Collision resistant: it is computationally infeasible to find two different inputs that produce the same hash.
A fourth property — the avalanche effect — means that a single-bit change in the input completely changes the output. "hello" and "hellO" produce entirely different SHA-256 hashes.
MD5: still useful, just not for security
MD5 (Message Digest 5) produces a 128-bit (32 hex character) digest. It was designed in 1991 and is fast — around 500 MB/s on modern hardware.
The problem: collision attacks against MD5 have been known since 2004. Two different files can be crafted to produce the same MD5 hash. This makes MD5 unsuitable for digital signatures, certificate fingerprinting, or any adversarial context.
Where MD5 is still fine:
- Checksums for non-adversarial integrity checking — verifying a downloaded file matches what the server sent over HTTPS (where the channel integrity is already guaranteed by TLS)
- Non-security deduplication — detecting duplicate files in a storage system
- Cache keys and sharding — fast hash-based partitioning where collision attacks are not a concern
SHA-1: deprecated but ubiquitous
SHA-1 produces 160-bit (40 hex character) digests. Git still uses SHA-1 as its object identifier by default. TLS certificates were required to stop using SHA-1 for signatures by 2017 after a practical collision (SHAttered) was demonstrated by Google researchers.
Like MD5, SHA-1 is acceptable for non-adversarial integrity checks but should not be used for new security code.
SHA-256, SHA-384, and SHA-512: the current standard
SHA-256 (256 bits, 64 hex chars), SHA-384 (384 bits, 96 hex chars), and SHA-512 (512 bits, 128 hex chars) are all part of the SHA-2 family and remain cryptographically strong. No practical attacks against any of them are known.
Use SHA-256 for:
- API request signing (HMAC-SHA256 is the standard for AWS, Stripe, Twilio, and most modern APIs)
- File integrity manifests
- Digital certificates (TLS 1.3 mandates SHA-256 or stronger)
Use SHA-384 when:
- Your target specification or compliance framework explicitly requires it (common in TLS 1.3 cipher suites like ECDHE-ECDSA-AES256-GCM-SHA384)
- The system you are integrating with mandates a 384-bit digest
Use SHA-512 when:
- The platform performs 64-bit arithmetic natively (SHA-512 is faster on 64-bit hardware than SHA-256 per byte)
- Extra margin is desired for very long-lived signatures
Hash functions vs password hashing
MD5, SHA-1, SHA-256, and SHA-512 are fast by design. Speed is excellent for checksums. It is catastrophic for password hashing — a modern GPU can compute billions of SHA-256 hashes per second, making brute-force attacks trivially fast.
For passwords, use a slow algorithm: bcrypt, scrypt, Argon2, or PBKDF2. These are intentionally slow and include a work factor you can tune upward as hardware improves. Never store passwords as SHA-256("password") — that hash appears in every rainbow table ever built.