SHA-256 vs SHA-3 vs MD5: Which Hash Should You Use?
A cryptographic hash turns any input into a fixed-size fingerprint. The same input always gives the same hash, and you can't reverse it back to the input. But not all hashes are equal — some are broken and should never be used for security.
Quick verdict
- MD5 — ❌ broken. Fast, but collisions are trivial. Fine only as a non-security checksum.
- SHA-1 — ❌ broken (collisions demonstrated). Avoid for anything new.
- SHA-256 / SHA-512 — ✅ secure and ubiquitous. The safe default for integrity, signatures and fingerprints.
- SHA-3 / Keccak — ✅ secure, a different internal design (sponge construction). Great when you want an alternative to SHA-2; Keccak-256 is used by Ethereum.
- BLAKE2 / BLAKE3 — ✅ secure and very fast — often faster than MD5 while being cryptographically strong.
The one rule people get wrong
None of these are for storing passwords. General-purpose hashes are designed to be fast, which is exactly what an attacker wants. For passwords, use a deliberately slow key-derivation function: bcrypt, scrypt or Argon2.
When to use which
- File integrity / checksums → SHA-256 (or BLAKE2 for speed).
- Digital signatures / certificates → SHA-256/384.
- Blockchain / Ethereum addresses → Keccak-256.
- Deduplication where security doesn't matter → even MD5 is acceptable.
- Passwords → none of the above — use Argon2/bcrypt.
Generate a hash now
The tools below compute all of these locally in your browser — your input never leaves your device.
Related tools
Hash Generator (SHA family) · SHA3-256 · MD5 · BLAKE2b · HMAC
Frequently asked questions
Is MD5 still safe to use?
Not for security. MD5 collisions are trivial to produce, so never use it for signatures, passwords or tamper detection. It's only acceptable as a fast non-security checksum.
Is SHA-3 better than SHA-256?
Neither is 'better' — both are secure. SHA-3 uses a different internal design (a sponge construction), which makes it a good alternative if you want diversity from the SHA-2 family.
Which hash should I use to store passwords?
None of the general-purpose hashes. Use a slow, salted key-derivation function such as Argon2, bcrypt or scrypt, which are designed to resist brute-force attacks.