MD5 is broken. MD5 is also everywhere — in download pages, build caches, file managers and a thousand internal tools. Both statements are true, and holding them at once requires understanding which guarantee broke and which jobs never depended on it.
What a hash promises
A cryptographic hash makes three distinct promises. Preimage resistance: given a digest, you cannot find an input that produces it. Second-preimage resistance: given one input, you cannot find a different input with the same digest. Collision resistance: you cannot find any two inputs that share a digest. The three sound alike; they fail independently, and a hash can lose one while keeping the others.
What actually broke in MD5
MD5 lost the third promise. Since 2004, researchers have been able to construct colliding MD5 inputs on purpose, and the technique has only gotten faster and cheaper — today a collision can be produced on ordinary hardware, and "chosen-prefix" collisions let attackers craft two meaningful, different files with the same MD5 digest. That capability was weaponised in the real world: the Flame malware used an MD5 collision to forge a Microsoft code-signing certificate. What did not break: preimage resistance. Nobody can take an MD5 digest and recover its input, and casually finding a second file matching a digest you were handed remains impractical.
SHA-1 followed the same arc a decade later — the SHAttered collision of 2017 and cheaper chosen-prefix attacks after it — which is why browsers and certificate authorities retired it, and why modern tooling defaults to the SHA-2 family.
So where does that leave MD5?
- Detecting accidental corruption — a flipped bit in a download or copy: MD5 still works. Accidents do not run collision attacks.
- Cache keys and content fingerprints in systems where nobody profits from a forged collision: fine.
- Anything adversarial — signatures, certificates, verifying a download against an attacker-influenced mirror, password storage: finished. Use SHA-256 (and for passwords, a dedicated password hash like bcrypt or argon2, never a bare fast hash).
And SHA-512? BLAKE2? The rest of the shelf
SHA-512 is SHA-256's larger sibling: same family, 128-hex-character digests, sometimes faster on 64-bit servers, no practical attacks. Choose it when a spec asks for it; you gain margin, not a different category of safety. SHA-3 is a genuinely different construction kept in reserve should SHA-2 ever fall. BLAKE2 and BLAKE3 are modern, fast and well-regarded, popular in tooling and content-addressed storage. None of this changes the practical guidance for ordinary work — the digest you want is the one your counterpart, your auditor and your platform's crypto library all support without a meeting, and in 2026 that is overwhelmingly SHA-256.
Why SHA-256 is the default answer
SHA-256 has no practical collision or preimage attacks, is implemented in hardware and in every platform's crypto library — including the Web Crypto API in your browser, which pointedly offers SHA-256 and SHA-512 while refusing MD5 entirely. Its 64-hex-character digests are a little longer to store and display; that is the entire cost. When a tool, a tutorial or a download page offers you a choice of digest in 2026, the decision has effectively been made for you: SHA-256, unless a legacy system dictates otherwise — and when it does, treat that as compatibility, not as safety. If you remember one distinction from all of this, make it that one: the question is never "is this hash broken?" but "broken for which promise, against which attacker?" MD5 still keeps the promises that casual integrity checks rely on; it lost the one that security depends on. Confusing the two is how broken algorithms end up guarding things, and how perfectly good ones get ripped out of places they were quietly serving well.
Try the tool behind this article: Hash Generator runs entirely in your browser — nothing you paste is uploaded.