Is MD5 Still Safe? When MD5 and SHA-1 Are (and Aren't) OK to Use

"MD5 is broken" is one of the most repeated facts in security, and one of the most misunderstood. Some people conclude that an MD5 checksum on a download is worthless; others keep hashing passwords with it because "nobody can reverse MD5". Both are wrong. Whether MD5 or SHA-1 is safe depends entirely on which property you rely on.

The three properties of a cryptographic hash

A collision attack lets an attacker create *two* inputs — both of their own choosing — that hash to the same value. It does not let them match a hash someone else already published. That distinction is the key to everything below.

How MD5 was broken

• 1991 — Ron Rivest publishes MD5, a 128-bit hash.
• 2004 — Xiaoyun Wang and colleagues demonstrate MD5 collisions in hours. Within a year, tools produce them in minutes.
• 2008 — Researchers use a *chosen-prefix* MD5 collision and a cluster of 200 PlayStation 3s to create a rogue certificate authority certificate trusted by every browser.
• 2012 — The Flame espionage malware is found signed with a forged Microsoft code-signing certificate, created with a novel MD5 chosen-prefix collision. This is the attack moving from research to nation-state operations.
• Today — Tools like HashClash generate identical-prefix MD5 collisions in seconds on ordinary hardware.

Despite all this, the best known preimage attack on MD5 has a complexity around 2¹²³ — still far out of reach. Nobody can take an arbitrary MD5 hash and compute an input for it.

How SHA-1 was broken

• 2005 — Theoretical attacks show SHA-1's collision resistance is weaker than its 80-bit design target.
• 2017 — SHAttered: Google and CWI Amsterdam publish two different PDF files with the same SHA-1 hash, at a cost of about 9 quintillion (2⁶³) SHA-1 computations.
• 2020 — SHA-1 is a Shambles: Leurent and Peyrin produce a practical *chosen-prefix* collision for around $45,000 of GPU time, and use it to impersonate a PGP key in the web of trust.
• Policy — Browsers stopped accepting SHA-1 TLS certificates in 2017, and NIST has announced SHA-1 must be retired from all uses by the end of 2030.

Why "MD5 decrypters" seem to work

Search for an MD5 hash online and you'll often find the input. That isn't a preimage attack — it's a lookup table. Sites store hashes of billions of common strings; if your input is among them, they find it. The MD5 of an empty string, d41d8cd98f00b204e9800998ecf8427e, is in every such table.

This is why MD5 is catastrophic for passwords — not because of collisions, but because it is fast and usually unsalted. A single modern GPU computes over 100 billion MD5 hashes per second, so every 8-character password can be tried in hours. A random 128-bit API token hashed with MD5, on the other hand, could never be found this way. (Use a proper password hash anyway: see Argon2 vs bcrypt vs scrypt.)

When MD5 and SHA-1 are still acceptable

If there is no adversary choosing the input, collision attacks don't apply. Reasonable uses include:

• Detecting accidental corruption — a bad download, disk errors, a truncated transfer. Random bit flips will never happen to produce a collision.
• Cache keys and ETags — mapping content to a short identifier for lookups.
• Deduplication of trusted data — your own backups or build artifacts.
• Sharding and partitioning — spreading keys evenly across buckets.
• Interoperating with legacy formats — some protocols and file formats specify MD5 or SHA-1, and you need to compute what they expect. Our MD5 generator and SHA-1 generator exist for exactly this.

When they are dangerous

Avoid MD5 and SHA-1 whenever an attacker could influence the data being hashed:

• Digital signatures and certificates — you sign a hash; a collision means one signature is valid for two documents.
• Integrity against tampering — if an attacker can prepare a benign file and a malicious one with the same hash, the checksum can't tell them apart.
• Deduplication of user-uploaded files — a malicious user can upload two colliding files and cause one to silently replace the other.
• Commitments and content addressing — anywhere the hash is treated as a unique identity of content.
• Password storage — fast hashes are crackable at enormous speed, regardless of collisions.

Git is an instructive case: it addresses every object by its SHA-1 hash. After SHAttered, Git switched to a hardened implementation (SHA-1DC) that detects the specific collision patterns, and has supported repositories using SHA-256 object names since version 2.29.

One more weakness: length extension

MD5, SHA-1 and SHA-256 share a structure (Merkle–Damgård) that allows a length-extension attack: knowing H(secret ‖ message) and the length of the secret, an attacker can compute H(secret ‖ message ‖ padding ‖ extra) without knowing the secret. This has broken real API signature schemes that authenticated requests with sha256(key + params).

The fix is to use HMAC for keyed hashing, which is immune. SHA-3, BLAKE2/BLAKE3 and SHA-512/256 are not vulnerable either.

What to use instead

$ printf '' | md5sum
d41d8cd98f00b204e9800998ecf8427e  -
$ printf '' | sha256sum
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  -

Both of those values are worth memorising: if you see them in a log or database, something hashed an empty input — a frequent sign of a bug.