Start with the protocol, not the longest result
If a publisher gives an MD5 reference, calculate MD5 to reproduce it. A SHA-256 value cannot be compared with the MD5 reference. If you control a new workflow and need a modern general-purpose fingerprint, SHA-256 is typically more appropriate than MD5. That does not make a plain hash an authentication scheme.
| Property | MD5 | SHA-256 |
|---|---|---|
| Digest size | 128 bits | 256 bits |
| Full hexadecimal length | 32 characters | 64 characters |
| Collision-resistant choice for a new security design | No | Modern SHA-2 option, subject to the whole protocol |
| Secret key in a plain digest | None | None |
| Reversible encryption | No | No |
What a matching pair establishes
Two matching computed values establish agreement under the selected comparison procedure, not who supplied the content. A reference delivered through the same compromised channel as a file can be changed with it. Use a trusted publisher channel, and follow a signature-verification process when authenticity is required.
MD5's collision weaknesses matter when an adversary deliberately constructs different data with the same digest. “It works for checking my copy” is not a reason to introduce MD5 into a new digital-signature format. Conversely, reproducing a legacy checksum may still be a legitimate compatibility task.
Compare the same bytes before blaming the algorithm
Text abc, abc plus a newline and a file that contains a UTF-8 byte-order mark are distinct inputs. Downloading an archive and hashing its extracted directory does not reproduce the archive checksum. Renaming a file normally leaves its contents unchanged; rebuilding or recompressing it may change embedded metadata and therefore its hash.
The MD5 homepage gives MD5 as the primary single-text result and also calculates SHA-256 and SHA-512. Use the algorithm labels to keep outputs distinct. For a file, select the requested algorithm and compare the full hexadecimal value, not a shortened visual prefix.
Authentication and passwords require different constructions
A keyed message-authentication requirement calls for a mechanism such as HMAC with a secret, not a plain hash or a guessed key-plus-message concatenation. Password storage needs a purpose-built password-hashing design with appropriate parameters, rather than simply choosing a longer fast digest.
A checksum tool is not an antivirus scanner, a signature verifier or a recovery service. If a check fails, identify the source of the expected value, the file release and the exact algorithm before deciding what action to take.
Practical handoff
Record algorithm, full digest and artifact version. Keep the trusted reference separately from unverified files. Export identifiers and calculated values if you need a local record, without exporting private source text or secret keys by default.