MD5 vs SHA-1 vs SHA-256 vs SHA-512
Published July 22, 2026By Samson PG
Quick answer
Same input, four digests — different lengths and threat models. Use SHA-256 (or SHA-512) for integrity; treat MD5 and SHA-1 as legacy unless a system forces them.
A cryptographic hash turns arbitrary input bytes into a fixed-length digest. Matching digests mean the inputs are almost certainly identical; a one-bit change flips the output. Developers reach for MD5, SHA-1, SHA-256, and SHA-512 for checksums, package manifests, and quick integrity checks — but they are not interchangeable for security.
Side-by-side
| Algorithm | Digest size | Security for new work | Typical use today |
|---|---|---|---|
| MD5 | 128-bit (32 hex) | Broken for collision resistance | Legacy checksums only |
| SHA-1 | 160-bit (40 hex) | Broken / deprecated | Old Git objects, legacy APIs |
| SHA-256 | 256-bit (64 hex) | Strong for integrity | Default checksums, many manifests |
| SHA-512 | 512-bit (128 hex) | Strong for integrity | High-assurance checksums, some HMACs |
Pick SHA-256 unless a publisher or protocol specifies otherwise. Prefer SHA-512 when a standard or policy asks for a longer digest. Reach for MD5 or SHA-1 only when verifying against an existing published hash that uses those algorithms.
What “broken” means here
Collision attacks craft two different inputs with the same digest. That matters for certificates, signatures, and anyone who might swap a malicious file for a benign one with a matching hash. MD5 and SHA-1 have practical collision issues; do not use them to prove authenticity of new software.
A matching hash still proves integrity against a known-good digest from a trusted channel. It does not prove the publisher is trustworthy — combine with signatures and HTTPS from a source you trust.
Text vs files
Text hashing depends on encoding. UTF-8 vs UTF-16, or a trailing newline, changes the digest. Prefer UTF-8 and normalize line endings when comparing across OSes.
Files are hashed as raw bytes. Browser tools read via FileReader / arrayBuffer() — when the tool is client-side, the file is not uploaded to our servers for processing.
Hashes are not password storage. Passwords need slow, salted KDFs (Argon2, bcrypt, scrypt). Do not “secure” a password by running MD5 or even SHA-256 alone.
Hash on TryDevSnip
- Open Hash Generator or an algo landing: MD5, SHA-1, SHA-256, SHA-512.
- Paste text or choose a file.
- Copy the hex digest and compare case-insensitively to the expected value.
- Switch algorithms only when the published checksum’s algorithm matches.
Privacy one-liner: hashing runs in your browser; input is not uploaded to our servers for processing.
Also see: SHA-256 checksums for text and files. Need identifiers instead of digests? Use the UUID Generator.
FAQ
Why does my hash differ from the website’s?
Wrong algorithm, encoding, BOM, trailing newline, or you hashed a ZIP instead of the inner file.
Is SHA-512 always “more secure” than SHA-256?
For integrity against collisions, both are fine for normal software checksums. SHA-512 is longer; some platforms also hash faster with SHA-512 on 64-bit CPUs. Follow the publisher’s stated algorithm.
Can I use these hashes for HMAC?
Yes in protocols that specify them (e.g. HMAC-SHA-256). That is a different construction than a bare checksum of a file.
Are browser hashes identical to sha256sum?
For the same bytes and algorithm, yes. Differences almost always mean different input bytes, not a different math library.