Digital & Text Tools

Why MD5 and SHA-1 Are Considered "Broken"

MD5 and SHA-1 are considered cryptographically broken because researchers have demonstrated practical methods to deliberately create two different inputs that produce the identical hash (a collision) — MD5 collisions were first demonstrated in 2004, and a full, practical SHA-1 collision was publicly demonstrated by Google and CWI Amsterdam in 2017 (known as the "SHATTERED" attack) — meaning both algorithms can no longer be trusted for security purposes like digital signatures, even though they remain fine for non-security uses like basic file-corruption checksums.

This is a real, well-documented part of cryptographic history, not a theoretical or exaggerated concern.

What a collision attack actually breaks

If an attacker can construct two different files or messages that hash to the same value, they can potentially substitute a malicious file for a legitimate one while producing an identical hash — defeating the entire purpose of using a hash to verify authenticity or detect tampering, which is why any security-relevant hashing needs an algorithm collisions haven't been demonstrated on.

Why they're still around despite being broken

MD5 and SHA-1 remain fast to compute and are still embedded in many older systems and legacy protocols, and for a non-security use — like a quick checksum to catch accidental file corruption or verify a download completed correctly — a collision attack isn't a realistic concern, since nobody's deliberately trying to construct a colliding file in that context.

Frequently asked questions

Should I ever use MD5 or SHA-1 for a password or security purpose?

No — for anything security-related, including password storage and digital signatures, use SHA-256 or SHA-512 (or, for password storage specifically, a purpose-built algorithm like bcrypt or Argon2, since even secure general-purpose hash functions aren't ideal for passwords on their own).

Is SHA-256 also at risk of being broken the same way?

As of now, SHA-256 has no known practical collision attack and is considered secure for current cryptographic use — cryptographic algorithms can weaken over time as computing power and research advance, which is part of why the field periodically retires older algorithms like MD5 and SHA-1 in favor of newer ones.