Password Encryption Online: MD5, SHA and Bcrypt Explained
People often use the term "password encryption" loosely, but the algorithms behind it are not interchangeable. Choosing the wrong one can leave user accounts exposed even when everything else about a system looks secure. This guide compares MD5, SHA and bcrypt, explains what hashing actually means, and shows you where each algorithm genuinely belongs.
Hashing versus encryption
Encryption transforms data so that someone holding the right key can reverse it back to the original. Hashing works differently. A hash function transforms input into a fixed length string that you cannot reverse back to the original value. When you type a password into a properly built login form, the system hashes what you typed and compares that hash against the one it stored, rather than ever storing your actual password. Our Password Encryption tool generates hashes using several common algorithms so you can see this process directly.
MD5 and SHA-1: fast, but not for passwords
MD5 and SHA-1 remain useful for quick checksums, such as confirming a downloaded file was not corrupted, or for generating a deterministic identifier from a piece of text. Security researchers have demonstrated practical collision attacks against both algorithms, meaning two different inputs can produce the same hash. That weakness matters far less for a file checksum than it does for a password, so neither algorithm belongs anywhere near password storage today.
SHA-256 and SHA-512: strong hashes, wrong tool for the job
SHA-256 and SHA-512 fix the collision weaknesses of their predecessors and work well for general purpose hashing, checksums and deterministic IDs. The problem for password storage is speed. These algorithms run extremely fast by design, which is exactly what you want for verifying a large file quickly, and exactly what you do not want for a password. A fast hash lets an attacker who steals a database of hashes test billions of guesses per second on ordinary hardware.
Bcrypt: built specifically for passwords
Bcrypt takes the opposite approach on purpose. It runs deliberately slowly, and it automatically generates a unique salt for every password it hashes, which prevents attackers from using precomputed tables to crack many passwords at once. This combination of built in salting and adjustable slowness makes bcrypt the right choice whenever an application needs to store user passwords. If you are building or reviewing a login system, confirm it hashes passwords with bcrypt, or a comparable algorithm such as Argon2, rather than a raw SHA or MD5 hash.
Choosing the right algorithm at a glance
- Storing user passwords: use bcrypt, or another dedicated password hashing algorithm.
- File checksums or deterministic IDs: SHA-256 or SHA-512 work well.
- Quick checksums or legacy compatibility: MD5 or SHA-1 remain usable, but avoid them for anything security sensitive.
Try it yourself
Generate a hash of any text with our Password Encryption tool, which supports MD5, SHA-1, SHA-256, SHA-384, SHA-512 and bcrypt. Once you understand hashing, it also helps to understand what makes a password worth hashing in the first place. Our password generator guide and password strength guide cover exactly that.
Back to all posts