Which Hash Algorithm Should You Use?
A short decision table, because the answer depends on whether an attacker can choose your input.
The only question that matters
Ask whether an adversary can influence the bytes you are hashing. If not — you are detecting bit-rot, deduplicating blobs, or busting a cache — almost any function works and you should pick for speed and availability. If yes, collision resistance is mandatory and only the SHA-2 and SHA-3 families qualify.
| Algorithm | Output | Collision status | Choose it for |
|---|---|---|---|
| MD5 | 128 bit | Broken (2004) | Legacy checksums, cache keys, non-adversarial integrity only |
| SHA-1 | 160 bit | Broken (SHAttered 2017) | Reproducing values from systems you do not control; git object IDs |
| SHA-256 | 256 bit | No known attack | The default for integrity, content addressing, code signing, JWT HS256 |
| SHA-512 | 512 bit | No known attack | Protocols that specify it; 64-bit native performance |
| SHA-3 / Keccak | 224–512 bit | No known attack | Diversity from Merkle–Damgård; sponge construction; NIST standard since 2015 |
| BLAKE3 | extendable | No known attack | Very high throughput, tree hashing, parallel verification |
| Argon2id | configurable | n/a | Password storage — memory-hard and deliberately slow |
Two mistakes that outrank algorithm choice
- Using a fast hash for passwords. No digest length saves you: a GPU tests billions of SHA-256 candidates per second, whereas Argon2id with a 64 MB memory cost runs thousands per second at best. The blocker is memory, not digest size.
- Comparing digests with
==. In dynamic languages two numeric-looking strings compare as numbers, so"0e111"equals"0e222". Always compare as constant-time strings.
Is a longer digest always safer?
No. Collision resistance grows as 2 to the power of half the digest length: 2^64 for MD5, 2^128 for SHA-256. Both MD5 and SHA-256 exceed what any attacker can reach by brute force, yet MD5 is broken because the attack is analytic, not brute force. Length buys headroom; it does not buy a sound design.
Migration advice that works: introduce SHA-256 alongside the old digest, store both for a release cycle, then drop the weak column. Never rewrite history in place if downstream systems depend on the old values.
How to use it
- Find your row in the table above.
- Confirm the 'collision status' column is acceptable for your threat model.
- If a secret is involved, switch to HMAC rather than a bare hash.
- If a password is involved, switch to Argon2id, scrypt or bcrypt.
Worth knowing
- MD5 collisions are constructible in seconds on commodity hardware today.
- SHAttered (2017) produced two PDFs sharing a SHA-1 digest.
- SHA-2 was published in 2001 and remains unbroken for collisions.
- NIST selected Keccak as SHA-3 in 2012 and standardised it in 2015.
Limitations
- This table describes cryptographic properties, not library availability in your language.
- Some hardware and FIPS profiles restrict which functions you may use.
- No hash provides keyed integrity — that requires HMAC or a signature.
- Performance varies enormously between native, hardware-accelerated and JavaScript implementations.