For a new general-purpose cryptographic hash, choose SHA-256 unless a protocol or compliance profile requires something else. Avoid MD5 and SHA-1 when collision resistance matters—especially when creating digital signatures. MD5 has a narrow remaining role in detecting accidental errors, while SHA-1 is mainly a legacy-compatibility concern as standards transition away from it.
What a hash does—and what it does not do
A cryptographic hash turns input of arbitrary length into a fixed-length digest. SHA-1 produces a 160-bit digest, SHA-256 produces a 256-bit digest, and MD5 produces a 128-bit digest. These sizes are specified in NIST’s Secure Hash Standard for SHA-1 and SHA-256 and IETF RFC 6151 for MD5.
As an Amazon Associate I earn from qualifying purchases.
A digest can help detect a change, but it does not automatically prove who created a file or that it came from a trusted source. If an attacker can replace both a file and the checksum published beside it, the attacker can make the two match. For authenticity, the expected digest must arrive through a trusted channel or be protected by an appropriate authenticated mechanism.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How MD5, SHA-1, and SHA-256 compare
| Algorithm | Digest size | Practical guidance |
|---|---|---|
| MD5 | 128 bits | Not suitable where collision resistance is required. A narrow use remains for inline error detection when there is no active attacker. |
| SHA-1 | 160 bits | Avoid for new uses requiring collision resistance, including new digital signatures. May remain relevant for legacy verification or a specifically permitted context. |
| SHA-256 | 256 bits | Defensible default for a new general-purpose hash among these three, subject to the target protocol and applicable policy. |
The longer digest is not the only reason to choose SHA-256. The decisive issue is whether the algorithm remains appropriate for the security property and context you need.
#1 Best Overall
When MD5 is still acceptable
MD5 has known collision weaknesses. RFC 6151 says it is no longer acceptable where collision resistance is required, such as for digital signatures. If an attacker can construct two different inputs with the same digest, a system that relies on collision resistance may accept a harmful substitution.
The RFC preserves a narrow distinction: “Where the MD5 checksum is used inline with the protocol solely to protect against errors, an MD5 checksum is still an acceptable use.” That means accidental transmission-error detection—not protection against deliberate tampering. A checksum downloaded from the same untrusted location as the file does not establish authenticity.
RFC 6151 also says existing HMAC-MD5 uses may not require urgent removal, but advises that new protocol designs should not include HMAC-MD5. That qualified legacy observation is not a recommendation for new authentication designs.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhere SHA-1 stands now
SHA-1’s 160-bit digest does not make it a sound choice for new collision-resistant applications. NIST says federal agencies should use SHA-2 or SHA-3 as an alternative to SHA-1, and its policy directs agencies away from SHA-1 for digital signatures, timestamps, and other applications requiring collision resistance. SHA-1 may still be encountered when verifying legacy material or where specific guidance permits it; that is different from generating new signatures.
In a December 15, 2022 announcement, NIST set December 31, 2030 as the date for federal agencies to complete their transition away from SHA-1 for applying cryptographic protection to all applications. NIST also said SHA-1 may still be needed to handle information protected before that date. This is a federal-agency transition plan, not a universal legal deadline for every private organization. NIST further stated that after December 31, 2030, FIPS 140-validated cryptographic modules listing SHA-1 as an approved algorithm would move to the historical list.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why SHA-256 is the default for a new use
SHA-256 is part of the SHA-2 family. NIST’s SP 800-131A Rev. 1 treats SHA-2 as acceptable for all hash-function applications covered by its guidance and encourages implementers to support SHA-256 at minimum when hash interoperability is needed. It is therefore the straightforward choice among these three for a new general-purpose cryptographic hash.
Rank #4
That is not permission to ignore the system around the hash. Follow the protocol’s current requirements, any required cryptographic-module validation, and your organization’s policy. For example, RFC 9155 specifically prohibits MD5 and SHA-1 signature hashes in TLS 1.2 and DTLS 1.2; protocol-specific requirements should be checked rather than inferred from a general recommendation.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Choose by the job you need the hash to do
- Creating a new digital signature: Do not use MD5 or SHA-1. Use an algorithm permitted by the signature scheme and applicable policy; SHA-256 is the sensible choice among the three discussed here.
- Checking for accidental file corruption: MD5 can serve as a basic error-detection checksum if accidental errors are the only concern. Prefer a digest obtained through a trusted channel if the file may be targeted.
- Verifying an old signature or archived material: SHA-1 may arise in legacy verification. Preserve the distinction between checking previously protected information and creating new protection, and follow the relevant validation rules.
- Implementing a named protocol or regulated system: Use that protocol’s current profile and your applicable compliance requirements, even if they narrow the general choice.
- Storing passwords: Do not treat this comparison as a password-storage recommendation. General-purpose hashes and password-hashing schemes solve different problems; the cited guidance here does not establish any of these three as suitable password storage.
A practical decision path
- Identify the security service you need: accidental error detection, adversarial integrity, collision resistance, or a digital signature.
- If an active attacker matters, do not rely on a bare checksum received alongside the data as proof of authenticity.
- For a new general-purpose hash among MD5, SHA-1, and SHA-256, select SHA-256 unless a named protocol, validation rule, or policy says otherwise.
- Keep MD5 or SHA-1 only where a specific legacy or narrowly permitted use justifies it, and avoid generating new collision-resistant protections with either one.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
