[{"data":1,"prerenderedAt":205},["ShallowReactive",2],{"content:en:guides\u002Fmd5-vs-sha256":3},{"id":4,"title":5,"body":6,"description":187,"extension":188,"faq":189,"kind":196,"locale":197,"meta":198,"navigation":199,"path":200,"seo":201,"seoTitle":202,"stem":203,"__hash__":204},"pages\u002Fen\u002Fguides\u002Fmd5-vs-sha256.md","MD5 vs SHA-256: choosing and comparing file hashes",{"type":7,"value":8,"toc":177},"minimark",[9,14,18,93,97,100,103,107,110,113,117,120,123,127,130,134,169],[10,11,13],"h2",{"id":12},"start-with-the-protocol-not-the-longest-result","Start with the protocol, not the longest result",[15,16,17],"p",{},"If a publisher gives an MD5 reference, calculate MD5 to reproduce it. A SHA-256 value cannot be compared with the MD5 reference. If you control a new workflow and need a modern general-purpose fingerprint, SHA-256 is typically more appropriate than MD5. That does not make a plain hash an authentication scheme.",[19,20,21,37],"table",{},[22,23,24],"thead",{},[25,26,27,31,34],"tr",{},[28,29,30],"th",{},"Property",[28,32,33],{},"MD5",[28,35,36],{},"SHA-256",[38,39,40,52,63,74,84],"tbody",{},[25,41,42,46,49],{},[43,44,45],"td",{},"Digest size",[43,47,48],{},"128 bits",[43,50,51],{},"256 bits",[25,53,54,57,60],{},[43,55,56],{},"Full hexadecimal length",[43,58,59],{},"32 characters",[43,61,62],{},"64 characters",[25,64,65,68,71],{},[43,66,67],{},"Collision-resistant choice for a new security design",[43,69,70],{},"No",[43,72,73],{},"Modern SHA-2 option, subject to the whole protocol",[25,75,76,79,82],{},[43,77,78],{},"Secret key in a plain digest",[43,80,81],{},"None",[43,83,81],{},[25,85,86,89,91],{},[43,87,88],{},"Reversible encryption",[43,90,70],{},[43,92,70],{},[10,94,96],{"id":95},"what-a-matching-pair-establishes","What a matching pair establishes",[15,98,99],{},"Two matching computed values establish agreement under the selected comparison procedure, not who supplied the content. A reference delivered through the same compromised channel as a file can be changed with it. Use a trusted publisher channel, and follow a signature-verification process when authenticity is required.",[15,101,102],{},"MD5's collision weaknesses matter when an adversary deliberately constructs different data with the same digest. “It works for checking my copy” is not a reason to introduce MD5 into a new digital-signature format. Conversely, reproducing a legacy checksum may still be a legitimate compatibility task.",[10,104,106],{"id":105},"compare-the-same-bytes-before-blaming-the-algorithm","Compare the same bytes before blaming the algorithm",[15,108,109],{},"Text abc, abc plus a newline and a file that contains a UTF-8 byte-order mark are distinct inputs. Downloading an archive and hashing its extracted directory does not reproduce the archive checksum. Renaming a file normally leaves its contents unchanged; rebuilding or recompressing it may change embedded metadata and therefore its hash.",[15,111,112],{},"The MD5 homepage gives MD5 as the primary single-text result and also calculates SHA-256 and SHA-512. Use the algorithm labels to keep outputs distinct. For a file, select the requested algorithm and compare the full hexadecimal value, not a shortened visual prefix.",[10,114,116],{"id":115},"authentication-and-passwords-require-different-constructions","Authentication and passwords require different constructions",[15,118,119],{},"A keyed message-authentication requirement calls for a mechanism such as HMAC with a secret, not a plain hash or a guessed key-plus-message concatenation. Password storage needs a purpose-built password-hashing design with appropriate parameters, rather than simply choosing a longer fast digest.",[15,121,122],{},"A checksum tool is not an antivirus scanner, a signature verifier or a recovery service. If a check fails, identify the source of the expected value, the file release and the exact algorithm before deciding what action to take.",[10,124,126],{"id":125},"practical-handoff","Practical handoff",[15,128,129],{},"Record algorithm, full digest and artifact version. Keep the trusted reference separately from unverified files. Export identifiers and calculated values if you need a local record, without exporting private source text or secret keys by default.",[10,131,133],{"id":132},"related-tools-and-guides","Related tools and guides",[135,136,137,145,151,157,163],"ul",{},[138,139,140],"li",{},[141,142,144],"a",{"href":143},"\u002F","MD5 Hash Generator",[138,146,147],{},[141,148,150],{"href":149},"\u002Ffile-md5","File checksum calculator",[138,152,153],{},[141,154,156],{"href":155},"\u002Fguides\u002Fmd5-checksum-windows","Check an MD5 file checksum on Windows",[138,158,159],{},[141,160,162],{"href":161},"\u002Fguides\u002Fmd5sum-linux","Use md5sum on Linux: files, manifests and newline checks",[138,164,165],{},[141,166,168],{"href":167},"\u002Fguides\u002Fwhat-is-md5","What is MD5? Bytes, 128-bit digests and common misconceptions",[15,170,171],{},[141,172,176],{"href":173,"rel":174},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc6151.html",[175],"nofollow","RFC 6151",{"title":178,"searchDepth":179,"depth":179,"links":180},"",2,[181,182,183,184,185,186],{"id":12,"depth":179,"text":13},{"id":95,"depth":179,"text":96},{"id":105,"depth":179,"text":106},{"id":115,"depth":179,"text":116},{"id":125,"depth":179,"text":126},{"id":132,"depth":179,"text":133},"Compare digest lengths, compatibility and trust assumptions without treating any matching checksum as proof of safety.","md",[190,193],{"question":191,"answer":192},"Can I compare a SHA-256 result with an MD5 reference?","No. MD5 uses 32 hexadecimal characters and SHA-256 uses 64. Calculate the exact algorithm specified by the reference; do not truncate or pad either value.",{"question":194,"answer":195},"Does choosing SHA-256 authenticate the publisher?","No. A plain digest has no secret key or signature. Obtain the reference through a trusted channel and follow the publisher’s signature-verification process when authenticity is required.","guide","en",{},true,"\u002Fen\u002Fguides\u002Fmd5-vs-sha256",{"title":5,"description":187},"MD5 vs SHA-256: choosing and comparing file hashes — md5hash.net","en\u002Fguides\u002Fmd5-vs-sha256","9xKXUEUAxVEb0CZNxUlwMg37dUMchbUlE21PwlOSSqs",1792048883701]