Hash Functions Compared: MD5, SHA-1, SHA-256 and CRC32

A hash function squeezes arbitrary input into a fixed-size fingerprint: the same file always yields the same string, while any tiny change avalanches into a completely different one. That one property serves three very different jobs — spotting corruption, fingerprinting content and, with extra machinery, protecting passwords.

1. Checksums for files: MD5, SHA-1, SHA-256

Download pages publish checksums so you can confirm a file arrived intact: hash your copy and compare strings. MD5 is the fastest and still fine for accidental-corruption checks, SHA-1 sits in the middle, and SHA-256 is the current default for anything that matters. Speed differences only show on gigabyte-scale files.

2. Broken for security, fine for integrity

MD5 and SHA-1 are shattered against deliberate attackers — researchers can craft two different files with the same MD5, and SHA-1 fell to a practical collision years ago. So never use them for signatures, certificates or password storage; but an attacker is not hiding inside your Linux ISO download, and for pure corruption detection they remain perfectly good.

3. Passwords need slowness, not speed

Fast hashes are the wrong tool for passwords because attackers can try billions of guesses per second. Real password storage uses slow, salted, memory-hard functions designed for the job. If a tutorial tells you to store MD5 of passwords, close that tutorial.

4. CRC32 and HMAC, briefly

CRC32 is not a cryptographic hash at all — it is a quick error-detecting code from networking and ZIP files, great for spotting transmission glitches and useless against forgery. HMAC, by contrast, mixes a secret key into the hash so the recipient can verify both integrity and authenticity. Try all of these on your own text or files with our hash generator, which computes everything locally in your browser.