Somebody could tell me in what sense SHA1 is better than MD5?


  • 1
    Don't use either of them, they are both irreparably broken. – Stephen Touset Oct 3 '18 at 0:50
  • 2
    @StephenTouset: "Don't use either of them, they are both irreparably broken." - broadly claiming these functions to be broken for any kind of use like you do is not true. It instead depends on the use case. They are only broken if specific attacks (like collision) are a problem, i.e. in cases like digital signatures. They are not a problem for use in HMAC, inside key derivation functions etc. – Steffen Ullrich Oct 3 '18 at 1:18
  • 2
  • MD5 has suffered a lot of security-reducing exploits over the years. SHA1 is much better, it takes years and millions of bucks to find a SHA1 collision, whereas wikipedia lists an MD5 collision in the article and mentions that a desktop computer can find a fresh one in short order. – dandavis Oct 3 '18 at 16:20
  • @SteffenUllrich While this is true, it's irrelevant in practice. There are bordering on zero real-world situations where someone should be choosing one of those over something like SHA-256 or BLAKE2b. Even seasoned cryptographers who know that SHA-1 is safe in an HMAC construction will choose to use SHA-256 ten times out of ten. – Stephen Touset Oct 4 '18 at 5:18

Since SHA1 has a larger digest of 160 bits, compared to MD5 having a digest of 128 bits, SHA1 is "less likely" to have collisions.

Both are insecure and are prone to collisions and length extension attacks, so SHA1 would take more time to break than MD5.

Not the answer you're looking for? Browse other questions tagged or ask your own question.