Should I use MD5 or SHA-256 for lookup?

The Quick Answer

For hash lookup and every security purpose, use SHA-256 — MD5 is cryptographically broken and cannot prove a file is the file you expected. MD5's collision resistance fell in 2004, meaning an attacker can craft two different files that share one MD5 hash, so a matching MD5 no longer authenticates anything. SHA-256 (256-bit, 64 hex characters) has no known practical collision, is the primary identifier in every modern threat-intelligence database, and is supported everywhere. Compute MD5 only as a fallback when querying legacy databases that predate widespread SHA-256 indexing — never to gate a security decision.

That is the summary an AI overview would give you. What it can't show you is how the two hashes actually differ when a real attacker is in the loop, or which one to reach for in a specific lookup workflow. The animated decision map below encodes that choice, followed by a side-by-side comparison, a migration path, and worked lookup examples you can copy.

Need the hashes themselves? Our Hash Generator computes MD5 and SHA-256 side by side in your browser, and the Hash Type Identifier tells you which algorithm produced a hash you have been handed.

However, the decision isn't always binary—sometimes both are computed, sometimes legacy systems require MD5, and understanding the tradeoffs helps you make informed decisions.

MD5: The Deprecated Hashing Algorithm

History

MD5 (Message Digest 5) was designed by Ronald Rivest in 1991 as a cryptographic hash function. It was widely adopted and became a standard for file verification and integrity checking.

MD5 characteristics:

• Output: 128-bit hash (32 hexadecimal characters)
• Speed: Very fast
• Collision resistance: Broken since 2004

Why MD5 is Broken

Collision attacks discovered (2004): Wang and Yu demonstrated that MD5's collision resistance was broken — two different inputs can be made to produce the same 128-bit hash output. This fundamentally violates the core security property of a hash function: that a matching hash means matching content.

Practical attacks (not theoretical):

• 2008 — researchers used a chosen-prefix MD5 collision to forge a rogue Certificate Authority certificate, letting them impersonate any HTTPS site (Sotirov et al.).
• 2012 — the Flame espionage malware abused an MD5 collision to fake a Microsoft code-signing certificate and spread via Windows Update.
• Today — generating an identical-prefix MD5 collision takes seconds on a laptop; chosen-prefix collisions take hours on commodity hardware.

How the attack works (conceptually):

Attacker crafts two files at once:
  File A = benign document/installer
  File B = malicious payload

Both are shaped (with collision blocks) so that:
  MD5(File A) == MD5(File B)   ← same 32-hex digest

Victim is shown MD5(File A) as the "known good" hash.
Attacker ships File B. The MD5 check passes. Malware runs.

The key point: the attacker controls both files and builds the collision in — MD5 gives them the freedom to do that, and SHA-256 does not.

When MD5 Still Appears

Despite being broken, MD5 persists in:

1. Legacy systems: Old software still using MD5
2. Backward compatibility: Supporting old file formats
3. Database records: Billions of MD5 hashes already in systems
4. Non-security uses: File deduplication, checksums (where collision not concern)
5. Hash lookup databases: Many include MD5 entries for historical coverage

Examples:

• VirusTotal: Accepts MD5 lookups (though uses SHA-256 primarily)
• Linux distributions: Some still provide MD5 checksums (legacy reasons)
• Legacy security software: Older antivirus products used MD5

SHA-256: The Modern Standard

History

SHA-256 (Secure Hash Algorithm 256-bit) was published by NIST in 2001 as part of the SHA-2 family, addressing weaknesses in MD5 and SHA-1.

SHA-256 characteristics:

• Output: 256-bit hash (64 hexadecimal characters)
• Speed: Fast (slower than MD5, but acceptable)
• Collision resistance: no known attack better than the 2¹²⁸ birthday bound
• No known practical attacks against the full 256-bit function

Why SHA-256 is Secure

Design improvements over MD5:

• Larger output (256-bit vs 128-bit) makes collisions exponentially harder
• More complex mathematical operations
• Designed with modern cryptanalysis in mind
• Extensively studied and peer-reviewed

Security properties:

• No known practical collision or preimage attack against the full function
• Best published collision results reach only 31 of its 64 rounds
• Collision resistance rests on a 2¹²⁸ birthday bound — far beyond any feasible computation

One caveat people get wrong: SHA-256 is not resistant to length-extension attacks. Like MD5 and SHA-1, it uses the Merkle–Damgård construction, so an attacker who knows SHA256(secret || message) and the length of secret can compute SHA256(secret || message || padding || extra) without ever learning the secret. This is why you must never authenticate a message with a bare SHA256(secret + data):

import hmac, hashlib

# WRONG — vulnerable to length extension
mac = hashlib.sha256(secret + message).hexdigest()

# RIGHT — HMAC is built to resist it
mac = hmac.new(secret, message, hashlib.sha256).hexdigest()

SHA-3 and the truncated SHA-2 variants (SHA-384, SHA-512/256) are structurally immune. For plain file integrity — the subject of this article — length extension is irrelevant, because there is no secret involved. It matters only when a hash is used as an authenticator.

Real-world adoption:

• NIST standard (FIPS 180-4)
• TLS/SSL certificates
• Bitcoin blockchain
• Digital signatures
• HMAC message authentication
• File integrity verification

Not password hashing. SHA-256 is deliberately fast, which is the opposite of what password storage needs — a modern GPU computes billions of SHA-256 hashes per second, so a salted SHA-256 password database still falls quickly to offline cracking. Use a purpose-built password hash with a tunable work factor: Argon2id (first choice), scrypt, bcrypt, or PBKDF2 where compliance requires it. Those functions use SHA-256 internally, but the deliberate cost parameter is the point.

MD5 vs SHA-256: Detailed Comparison

Aspect	MD5	SHA-256
Release Date	1991	2001
Output Size	128-bit	256-bit
Security Status	Cryptographically Broken	Secure
Known Attacks	Collision attacks practical	No practical attacks
Speed	Very fast (~600 MB/s)	Fast (~400 MB/s)
Collision Resistance	Broken in practice (seconds on a laptop)	No known attack
Preimage Resistance	Theoretically weakened (2123.4), not practically broken	No known attack
Length-Extension Resistance	Vulnerable	Also vulnerable — use HMAC or SHA-512/256
Database Coverage	Legacy systems	Universal
Verification Use	Not recommended	Recommended
Certificate Signing	Deprecated	Standard
Recommended for New Systems	No	Yes

When to Use Each

Use SHA-256

Always use SHA-256 for:

• New implementations
• Security-critical applications
• File integrity verification
• Digital signatures
• Message authentication (via HMAC-SHA-256, not bare SHA-256)
• Certificate signing
• Hash lookups for malware detection

For password storage, use Argon2id, scrypt, or bcrypt instead — see the note above.

Examples:

# Verifying downloaded Linux ISO
sha256sum ubuntu-24.04-desktop-amd64.iso

# Checking file integrity after transfer
sha256sum important_document.pdf

# Verifying software authenticity
sha256sum software_installer.exe

# Hash lookup for security analysis
virustotal.com (upload file or SHA-256)

Use MD5 Only When

Legacy compatibility necessary:

• Supporting old systems that only provide MD5
• Integrating with systems that can't be updated
• Backward compatibility with existing databases
• Migrating from MD5 to SHA-256

Non-security uses:

• File deduplication (where collision not security risk)
• Checksums for file transfer integrity (non-adversarial)
• Cache invalidation
• Database indexing (non-security)

Examples:

# Legacy system that requires MD5
# Old antivirus database lookup
# Supporting outdated API that only accepts MD5

Never Use MD5 For

• ✗ Security-critical integrity checking
• ✗ Digital signatures or certificate signing
• ✗ Password hashing (MD5 or SHA-256 — use Argon2id)
• ✗ Authenticating downloads
• ✗ Access control decisions
• ✗ Deduplication where a user controls the input (a deliberate collision lets one file displace another)

Worth being precise about hash lookup. Querying a reputation database with an MD5 you computed is not itself dangerous — you are asking a question, not trusting the hash to authenticate anything. A hit is meaningful evidence. What you cannot safely do is treat a miss, or a match against a known-good MD5, as proof a file is clean: an attacker can craft a malicious file sharing a benign file's MD5. Look up MD5 freely for coverage; make the actual decision on SHA-256.

Try it yourself

• Hash Generator — compute MD5, SHA-1, SHA-256, and SHA-512 for a file or string, in-browser
• Hash Lookup — check a hash against threat-intelligence sources
• Hash Type Identifier — work out which algorithm produced an unlabelled hash (a 32-character hex string is MD5; 64 characters is SHA-256)

Hash Lookup: MD5 vs SHA-256

Hash Lookup Databases

VirusTotal:

• Accepts: MD5, SHA-1, SHA-256
• Recommends: SHA-256 or SHA-1
• Deprecating: MD5 for security-critical lookups
• Storage: Has records for billions of MD5 hashes (legacy coverage)

NSRL (National Software Reference Library):

• Primarily: SHA-1 and MD5
• Newer entries: Include SHA-256
• Legacy: Extensive MD5 coverage from decades of collection

YARA/Threat Intelligence:

• Modern implementations: SHA-256 primary
• Legacy: May include MD5
• Best practice: Use SHA-256

Recommendation for Hash Lookup

For current investigations: Use SHA-256

# Get SHA-256 of suspicious file
sha256sum suspicious_file.exe
# Look up in VirusTotal/Hybrid Analysis

For legacy searches: May need MD5

# If database only supports MD5
md5sum suspicious_file.exe
# Look up in older security tools

Best practice: Compute both

# Generate both hashes
sha256sum file.exe → abc123...
md5sum file.exe → def456...

# Check SHA-256 in modern databases first
# Fall back to MD5 if needed for legacy systems

Migration Path: MD5 to SHA-256

Organizations should plan migration:

Phase 1: Dual Support (Current)

New systems use SHA-256
Legacy systems continue MD5
Both supported where applicable

Phase 2: Gradual Transition

Compute and store both hashes
Prioritize SHA-256 in new workflows
Maintain MD5 for backward compatibility

Phase 3: SHA-256 Primary

All new implementations: SHA-256
Legacy MD5 queries: Supported but not recommended
Documentation emphasizes SHA-256

Phase 4: MD5 Deprecation (Years Away)

MD5 support removed from security-critical functions
Legacy systems individually upgraded
MD5 retained only for non-security deduplication

Timeline: 5-10 years before MD5 truly phased out from security systems.

Practical Hash Lookup Examples

Example 1: Verifying Downloaded Software

Scenario: Download Firefox installer, publisher provides SHA-256 hash

Process:

# Compute hash
sha256sum Firefox-Setup-130.0.exe

# Verify matches published hash
Published: 3a9d7b2c1e4f6a8b5c7d9e0f1a2b3c4d...
Computed:  3a9d7b2c1e4f6a8b5c7d9e0f1a2b3c4d...
Match: ✓ Verified

Result: File integrity confirmed, safe to install.

Example 2: Investigating Suspicious File

Scenario: Received suspicious email attachment, want to check if it's malware

Process:

# Compute SHA-256
sha256sum unknown_attachment.exe
abc123...

# Look up in VirusTotal
# Result: 42 malware detections, known as Trojan.Win32.Generic

Result: File is malware, don't execute, quarantine.

Example 3: Legacy System Hash Lookup

Scenario: Old antivirus tool only accepts MD5

Process:

# Compute MD5 (only option for this tool)
md5sum old_suspicious_file.exe
5d41402abc4b2a76b9719d911017c592

# Look up in legacy database
# Result: Known malware, quarantine

Note: In modern system, would use SHA-256 instead.

Why Hash Lookup Works Better with SHA-256

Coverage

Modern threat intelligence databases prioritize SHA-256:

• New malware samples: Submitted with SHA-256
• Modern tools: Generate SHA-256 hashes
• Future databases: SHA-256 native

MD5 has better historical coverage but declining new entries.

Reliability

SHA-256 lookups are more reliable because:

• No collision risks (MD5 collisions theoretically possible)
• Stronger filtering of false positives
• Better detection algorithm integration
• More database contributors use SHA-256

Integration

Modern security tools integrate SHA-256:

• VirusTotal API: Prefers SHA-256
• Hybrid Analysis: SHA-256 primary
• EDR platforms: Use SHA-256
• SIEM systems: SHA-256 standard

Conclusion

For hash lookup and all security purposes: Use SHA-256.

MD5 is cryptographically broken and should be avoided for anything security-related. While legacy systems and databases still contain MD5 hashes, and some tools still accept MD5 input, SHA-256 is the clear modern standard.

When investigating files or verifying integrity:

1. Compute SHA-256 hash
2. Look up in modern databases (VirusTotal, Hybrid Analysis, etc.)
3. Use MD5 only if specifically required by legacy systems
4. Plan migration away from MD5 in your organization

The extra 32 hexadecimal characters in a SHA-256 hash versus MD5 represent 128 additional bits of security—a worthwhile investment for protecting your systems and data.