These three are all called "hashes", but they solve different problems. MD5 is a fast hash whose collision resistance has been broken since 2004; keep it only for non-adversarial checksums. SHA-256 is the fast, secure general-purpose choice for file integrity, signatures and HMAC. bcrypt is a password-hashing function that is slow on purpose and salts automatically; use it (or Argon2 or scrypt) for passwords, and never MD5 or plain SHA-256.
At a glance
| Property | MD5 | SHA-256 | bcrypt |
|---|---|---|---|
| Designed for | General hashing (1992) | General hashing (SHA-2 family, 2001) | Password storage (1999) |
| Output | 128 bits, 32 hex characters | 256 bits, 64 hex characters | 60-character string with version, cost, salt and hash |
| Speed | Very fast | Fast | Deliberately slow, tunable |
| Salt | None (you add it yourself) | None (you add it yourself) | 128-bit salt built in |
| Work factor | None | None | Cost parameter: 2^cost rounds |
| Input limit | Practically none | Practically none | Only the first 72 bytes are used |
| Collision resistance | Broken: collisions take seconds | No known attack | Not the goal |
| Use it for | Non-security checksums only | File integrity, signatures, HMAC, content IDs | Passwords |
The same input through each:
| Function | Input correct horse battery staple |
|---|---|
| MD5 | 9cc2ae8a1ba7a93da39b46fc1019c481 |
| SHA-256 | c4bbcb1fbec99d65bf59d85c8cb62ee2db963f0fe106f483d9afa73bd4e39a8a |
| bcrypt, cost 12 | $2a$12$dPxev78KNUQr7ZVJEsj1QuHnlgkTm.VnudJ/Cny1cr4OIlm0ogWU. |
MD5 and SHA-256 always give the same output for the same input. bcrypt gives a different string every time because it picks a new random salt; the string stores the version (2a), the cost (12), the 22-character salt and the 31-character hash, which is everything needed to verify a password later. Try all three with the Hash Generator and the Bcrypt Generator.
MD5
MD5 is fast and still everywhere, but practical collisions (two different inputs with the same hash) were published in 2004, and chosen-prefix collisions followed, which were used to forge a rogue CA certificate in 2008 and to sign the Flame malware in 2012. An attacker who can influence the input can make two files share an MD5 hash.
Choose MD5 only when: you are detecting accidental damage, such as a download that broke in transit, and nobody gains anything by faking a match, or a legacy system publishes nothing else. Even then, SHA-256 costs little extra.
SHA-256
SHA-256 is part of the SHA-2 family standardised by NIST. No practical collision or preimage attack is known, and modern CPUs have dedicated instructions for it. It is what package managers, Git's newer object format, TLS certificates, code signing and Bitcoin rely on.
Choose SHA-256 when: you need a fingerprint of data: verifying a download with the File Checksum Calculator, content-addressed storage, digital signatures, or a message authentication code. For a MAC, use HMAC-SHA-256 (try the HMAC Generator) rather than SHA-256(key + message), which is open to length-extension attacks.
Do not choose it for passwords. Its speed is exactly what a password cracker wants.
bcrypt
bcrypt is built on the Blowfish cipher's expensive key setup, repeated 2^cost times. Raising the cost by one doubles the work: generating a hash in JavaScript took about 55 ms at cost 10, 105 ms at cost 11 and 213 ms at cost 12 in our test, and an attacker pays the same price for every single guess. The salt is generated and stored for you, so two users with the same password get different hashes.
Choose bcrypt when: you store passwords. It is supported almost everywhere, including web-server password files (see the htpasswd Generator). Watch the 72-byte input limit: longer passphrases are silently truncated. Argon2id, the winner of the Password Hashing Competition, is the stronger modern choice where available because it is also memory-hard, which blunts GPU attacks.
Which should you choose?
- Storing user passwords: bcrypt (cost 10 to 12 or higher), or Argon2id or scrypt. Never MD5 or SHA-256 alone, salted or not.
- Checking a file or download: SHA-256. Use MD5 only if it is the only checksum published.
- Signing or authenticating messages: HMAC-SHA-256 or a real signature scheme.
- Generating IDs or cache keys from content: SHA-256 (truncate it if you need something shorter).
- Anything security-related in new code: not MD5.
For how the functions work inside, see How Hashing Works.