How Cryptographic Hashes Work: MD5 vs SHA-256 Security Guide

## What Is a Cryptographic Hash Function? A cryptographic hash function is a mathematical algorithm that maps data of arbitrary size to a bit array of a fixed size (called the "hash digest" or "checksum"). It is designed to be a one-way function—a function that is practically infeasible to invert or reverse. ### Five Fundamental Properties of Secure Hashes 1. **Deterministic**: The exact same input message will always produce the identical hash digest output. 2. **Quick Computation**: The algorithm can evaluate the hash value quickly for any given data. 3. **Pre-image Resistance (One-Way)**: Given a hash output *h*, it is computationally infeasible to find any original message *m* such that *hash(m) = h*. 4. **Small Changes Change the Output (Avalanche Effect)**: Changing even a single bit in the input message completely randomizes the resulting hash output. 5. **Collision Resistance**: It is computationally infeasible to find two completely different input messages that produce the exact same hash output. ### MD5 vs SHA-256: Which Should You Use? - **MD5 (Message Digest 5)**: Created in 1991 by Ronald Rivest. It produces a 128-bit (32 hexadecimal character) digest. In 2004, researchers demonstrated practical hash collisions. While MD5 remains widely used for rapid file checksum verification and non-security cache keys, it must **never** be used for password hashing, digital signatures, or SSL certificates. - **SHA-256 (Secure Hash Algorithm 2)**: Developed by the National Security Agency (NSA) as part of the SHA-2 family. It outputs a 256-bit (64 hexadecimal character) digest and is mathematically robust against known collision attacks. SHA-256 powers Bitcoin proof-of-work, TLS 1.3 handshakes, and Git repository signatures.