MD5 and SHA-1 Deprecation Guide

The Rise and Fall of MD5 and SHA-1

MD5 and SHA-1 were once the standard hash functions for verifying file integrity, storing passwords, and signing digital certificates. MD5 produces a 128-bit digest; SHA-1 produces 160 bits. At the time of their adoption, the computational cost of finding two inputs that produce the same hash — a collision — was considered impractical.

That assumption collapsed. In 2004, researchers demonstrated practical MD5 collisions. By 2008, attackers forged a rogue CA certificate using MD5 collisions. SHA-1 held on longer, but in 2017 Google's SHAttered attack produced two different PDF files with the same SHA-1 hash. Both functions are now officially deprecated for security purposes.

What a Collision Attack Means

A hash function maps arbitrary input to a fixed-size digest. A collision occurs when two distinct inputs produce the same hash output:

File A → SHA-1 → a3bf2a57... (40 hex chars)
File B → SHA-1 → a3bf2a57... (same digest — collision)

If you trust the hash to verify File A, an attacker can substitute File B and the hash still matches. This breaks integrity verification for software downloads, digital signatures, and certificate chains.

Collision vs Preimage

Collision attacks are enough to break real-world systems. An attacker does not need to reverse a specific hash — they only need to produce a malicious file that shares a hash with a legitimate one.

Where MD5 and SHA-1 Still Appear

Despite deprecation, these hashes remain embedded in many systems:

• Legacy checksums — older software releases ship with MD5 checksums for verification
• Git — Git uses SHA-1 internally for object identification (migration to SHA-256 is in progress)
• Database identifiers — some systems use MD5 as a low-collision key generator
• Non-security contexts — deduplication, cache keys, and partition selectors where collision resistance is not a security requirement

Using MD5 or SHA-1 for non-security purposes (like cache keys or deduplication) is acceptable. The problem is when they are used where trust depends on collision resistance.

Migrating to SHA-256

SHA-256 (part of the SHA-2 family) produces a 256-bit digest and has no known practical collision attacks. It is the current standard for most security applications.

Code Migration

// Before — Node.js crypto
const hash = crypto.createHash('md5').update(data).digest('hex');

// After
const hash = crypto.createHash('sha256').update(data).digest('hex');

# Before — command line
md5sum release.tar.gz

# After
sha256sum release.tar.gz

Database Migration

For systems that store hashes as identifiers or checksums:

1. Add a new sha256 column alongside the existing md5 column
2. Backfill SHA-256 hashes for all existing records
3. Update application code to write both hashes during the transition
4. Switch reads to SHA-256 and remove the MD5 column

SHA-3: The Next Generation

SHA-3 (Keccak) is not a refinement of SHA-2 — it uses a completely different internal construction (sponge function vs Merkle-Damgard). This structural diversity means a future break in SHA-2 would not automatically compromise SHA-3.

For most applications today, SHA-256 is sufficient. SHA-3 is worth adopting for long-lived systems where defense in depth against future cryptanalytic advances matters.

Password Hashing Is Different

MD5, SHA-1, SHA-256, and SHA-3 are all general-purpose hash functions. They are designed to be fast. For password storage, fast is dangerous — attackers can guess millions of passwords per second.

Use purpose-built password hashing functions instead:

• bcrypt — battle-tested, widely supported
• Argon2 — winner of the Password Hashing Competition, resistant to GPU attacks
• scrypt — memory-hard, effective against ASIC attacks

Never use MD5, SHA-1, or SHA-256 alone for password storage without a salt and key stretching.

Key Takeaways

• MD5 and SHA-1 are broken for collision resistance — do not use them for security purposes.
• Collision attacks are practical: attackers can produce two files with the same hash.
• SHA-256 is the recommended replacement with no known vulnerabilities.
• SHA-3 offers structural diversity as a hedge against future breaks in SHA-2.
• Migration involves adding SHA-256 alongside existing hashes, then switching over.
• For password storage, use bcrypt or Argon2 — never general-purpose hash functions.

Try It Yourself

Generate SHA-256 hashes for your files and strings instantly with the Hash Calculator.