Cryptography › Module 1 › Lesson 2
MD5, SHA-1, SHA-256
Compare legacy MD5/SHA-1 with SHA-256—and when each is still seen in the wild
Opening
Old hashes still haunt systems
You will still meet MD5 in legacy software and SHA-1 in old certificates or git history jokes. Knowing what is deprecated—and why—stops you from building new systems on sand.
1. The Short Version
MD5
128-bit digest. Collision attacks are practical. Do not use for security (integrity of untrusted downloads, signatures, passwords).
SHA-1
160-bit. Collision attacks demonstrated. Retired for signatures and certificates; avoid for new designs.
SHA-256
Part of SHA-2 family. 256-bit digest. Widely used for file integrity, blockchain, TLS ecosystem, and general hashing.
2. Try Them Side by Side
Compare digests in Pythonimport hashlib data = b"cyberlium-lab" print("MD5 ", hashlib.md5(data).hexdigest()) print("SHA-1 ", hashlib.sha1(data).hexdigest()) print("SHA256", hashlib.sha256(data).hexdigest())
import hashlib
data = b"cyberlium-lab"
print("MD5 ", hashlib.md5(data).hexdigest())
print("SHA-1 ", hashlib.sha1(data).hexdigest())
print("SHA256", hashlib.sha256(data).hexdigest())OpenSSL equivalentsecho -n "cyberlium-lab" | openssl dgst -md5 echo -n "cyberlium-lab" | openssl dgst -sha1 echo -n "cyberlium-lab" | openssl dgst -sha256
echo -n "cyberlium-lab" | openssl dgst -md5 echo -n "cyberlium-lab" | openssl dgst -sha1 echo -n "cyberlium-lab" | openssl dgst -sha256
Broken for collisions ≠ useless for everything
MD5 may still appear as a non-security checksum in old pipelines. Never treat it as proof against a motivated attacker.
Knowledge Check
Which hash is preferred for new security designs?
Multiple choice
Knowledge Check
True or False: Practical collision attacks exist against MD5.
True or False
Knowledge Check
SHA-1 was largely retired from certificates because of:
Multiple choice