SHA256 vs MD5: Which Hash Should You Use? — Practical Guide

Use SHA-256 for general file checksums

A SHA-256 digest is useful for checking whether a file matches a known reference value. Compute it after downloading and compare every character with the publisher’s value obtained through a trusted channel. If an attacker can replace both the file and the checksum, the comparison does not prove authenticity. Use a digital signature or authenticated distribution mechanism when you need to verify the publisher.

Do not use MD5 for security-sensitive integrity

Practical collision attacks make MD5 inappropriate where an attacker may choose inputs and exploit two different files with the same digest. It may still appear in legacy protocols or non-security identifiers, but avoid introducing new security dependencies on it. A collision is different from finding a preimage for an arbitrary hash; explain the threat model precisely instead of saying that every MD5 value can be reversed.

Choose a password hashing function for passwords

Password storage needs a slow, salted password-hashing algorithm designed to resist guessing attacks, such as Argon2id, scrypt, bcrypt, or PBKDF2 where required by the platform. A fast cryptographic hash lets attackers test guesses too quickly. Use a maintained library with sensible parameters and unique salts. For message authentication, use a keyed construction such as HMAC rather than an unkeyed digest.

Worked example

File: release.zip
Expected SHA-256: <digest published by the trusted project>
Computed SHA-256: <digest of downloaded file>
Compare: exact match, then verify the publisher/signature when authenticity matters

Is SHA-256 safe for storing passwords?

A raw SHA-256 hash is too fast for password storage. Use a dedicated salted password-hashing algorithm with current parameters.

Reference and further reading

Read the official documentation ↗