Updated July 1, 2026
Hash algorithms reference
A quick comparison of common cryptographic and checksum hash algorithms: how long each digest is and whether it is still considered secure. Longer is not automatically better, but broken algorithms should be avoided for security.
Algorithms
| Algorithm | Output | Hex length | Status / use |
|---|---|---|---|
MD5 | 128-bit | 32 chars | Broken — checksums only, never security |
SHA-1 | 160-bit | 40 chars | Broken — deprecated for security |
SHA-256 | 256-bit | 64 chars | Secure — recommended default |
SHA-512 | 512-bit | 128 chars | Secure — larger digest, fast on 64-bit |
Hashing is not for passwordsEven SHA-256 is too fast for storing passwords. Use a purpose-built, slow algorithm such as
bcrypt, scrypt, or Argon2 with a per-user salt.Hex length = bits / 4Each hex character encodes 4 bits, so a 256-bit hash is 64 hex characters. That is why SHA-256 output is always 64 characters regardless of the input length.
References
Questions
How long is a SHA-256 hash?
A SHA-256 digest is 256 bits, which is 64 hexadecimal characters. The length is fixed no matter how long or short the input is.
Is SHA-256 better than MD5?
Yes for security. MD5 is broken and vulnerable to collisions, while SHA-256 is still considered secure. Use MD5 only for non-security checksums, if at all.