MD5 vs SHA-256: which checksum to use

Use SHA-256 for checksums. MD5 and SHA-1 are broken for security, because attackers can make two different files with the same hash, but they still catch accidental corruption. To verify a download on a Mac, run shasum -a 256 file and compare the result with the checksum the publisher gives. For passwords, use bcrypt or Argon2, never a plain hash.

What a hash is

A hash function takes any input, a word or a large file, and produces a fixed-length fingerprint. The same input always gives the same hash. Change one byte and the hash changes completely. A good cryptographic hash has three properties:

• One way. You cannot work back from the hash to the input.
• Collision resistant. Nobody can find two different inputs with the same hash.
• Second preimage resistant. Given a file, nobody can make a different file with the same hash.

Those properties make hashes useful for checking that a file arrived intact, that a download has not been swapped, or that two copies of something are identical without comparing them byte by byte.

MD5 and SHA-1: broken, but not useless

MD5 produces a 128-bit hash and SHA-1 a 160-bit one. Both have been broken for collisions: researchers have shown practical ways to produce two different inputs with the same MD5 hash, and the same for SHA-1. That means an attacker can prepare a harmless file and a malicious one that share a hash. If you trust MD5 to prove a file is genuine, you can be fooled.

For non-security jobs, they still work. If you want to know whether a file got corrupted on a copy, whether two files in a folder are duplicates, or whether a cache entry has changed, an accidental collision is not a realistic worry. MD5 is quick and short, which is why it is still used for these jobs. Just do not use it where someone might want to fool you.

SHA-256 for checksums

SHA-256 is part of the SHA-2 family and produces a 256-bit hash, written as 64 hexadecimal characters. No practical collision attack on it is known, and it is the common choice for verifying software downloads, signing data and building systems such as Git's newer object format. When a publisher lists a checksum today, it is usually SHA-256. Use it by default; there is rarely a reason to choose MD5 for new work.

Hashing a file on a Mac

macOS includes shasum and md5. Run them in Terminal:

# SHA-256 of a file
shasum -a 256 file.dmg

# MD5 of a file
md5 file.dmg

# hash a string (note -n, so no new line is hashed)
echo -n 'hello' | shasum -a 256

The -n on echo matters for the same reason it does with Base64: without it, a new line is added and hashed, and you get a different answer from every other tool. The guide on Base64 on a Mac covers that trap in more detail. On Linux, the equivalent commands are sha256sum and md5sum.

Verifying a download's checksum

When a site publishes a checksum next to a download, you can check that the file you got is the file they released.

1. Download the file and note the published SHA-256 value.
2. Run shasum -a 256 on the file.
3. Compare the two values. Every character must match. Comparing the first and last few is not enough.

To let the tool compare for you, put the expected value and the file name in a line and pass it to -c:

echo 'EXPECTED_HASH  file.dmg' | shasum -a 256 -c
# file.dmg: OK

A checksum only helps if it comes from a source you trust more than the download. If an attacker controls the page that lists both, they can change both. That is why code signing, which macOS checks for you, matters too.

Hashing is not encryption, and passwords need more

Encryption is two way: with the key, you get the original back. Hashing is one way: there is no key and no way back. People sometimes say a password is "encrypted with SHA-256". It is not; it is hashed, and that distinction matters.

A plain SHA-256 of a password is still a bad way to store it. SHA-256 is designed to be fast, so an attacker with a stolen database can try a huge number of guesses per second. Use a password hashing function built to be slow and salted: bcrypt, scrypt or Argon2. Most frameworks include one. Never write your own. And never store passwords somewhere an AI chat or a log could pick them up; see keeping secrets out of AI prompts.

How DailyUtil does it

DailyUtil's Hash Generator is one of the free tools in the Mac app. It hashes text on your Mac, offline, so nothing you paste is sent anywhere by the tool. DailyUtil itself is signed and notarised by Apple, and the download page is where to get it, for macOS 14 or later on Apple Silicon. The security page explains how the app handles your data.

Questions people ask

Is MD5 still safe to use?

Not for security. MD5 collisions can be made deliberately, so it cannot prove a file is genuine. It is still fine for catching accidental corruption or finding duplicate files, where nobody is trying to trick you.

How do I check a SHA-256 checksum on a Mac?

Open Terminal and run shasum -a 256 followed by the file path. Compare the 64 character result with the checksum the publisher lists. Every character must match exactly for the file to be the same.

Can a SHA-256 hash be reversed?

No. Hashing is one way and has no key. Short or common inputs such as weak passwords can be guessed by hashing candidates and comparing, which is why passwords need a slow, salted hash like bcrypt or Argon2.

Should I use SHA-256 to store passwords?

No. SHA-256 is fast, which helps attackers guess at scale. Use a dedicated password hashing function such as bcrypt, scrypt or Argon2, which is slow by design and adds a salt to every password.