Hash & Encryption Algorithms Cheat Sheet
Hash and encryption cheat sheet: output length, security status and best-use cases for MD5, SHA-1, SHA-256, SHA-3, HMAC, password hashing (bcrypt/scrypt/Argon2) and AES/RSA/ECC.
| Algorithm | Type | Output / Length | Security | Best use |
|---|---|---|---|---|
| MD5 | Hash | 128 bit | Broken | File checksums (non-security only) |
| SHA-1 | Hash | 160 bit | Collided, deprecated | Legacy compatibility, Git objects |
| SHA-224 | Hash (SHA-2) | 224 bit | Secure | Rarely used SHA-2 variant |
| SHA-256 | Hash (SHA-2) | 256 bit | Secure | Certificates, blockchain, signatures (most common) |
| SHA-384 | Hash (SHA-2) | 384 bit | Secure | Higher security requirements |
| SHA-512 | Hash (SHA-2) | 512 bit | Secure | Higher security requirements |
| SHA-3 | Hash (Keccak) | 224/256/384/512 bit | Secure | Standardized alternative to SHA-2 |
| RIPEMD-160 | Hash | 160 bit | Mostly secure | Bitcoin address generation |
| HMAC | MAC | Follows base hash | Secure (needs key) | API signing, webhook verification |
| bcrypt | Password hashing | 60 chars | Secure (tunable cost) | Password storage (widely supported) |
| scrypt | Password hashing | Variable | Secure (memory-hard) | ASIC-resistant password storage |
| Argon2 | Password hashing | Variable | Secure (modern default) | Preferred for new projects |
| PBKDF2 | Password hashing | Variable | Secure (iterations) | Scenarios needing compatibility |
| AES | Symmetric encryption | 128/192/256 bit | Secure | Data encryption (prefer GCM mode) |
| RSA | Asymmetric encryption | 2048/4096 bit | Secure (long keys) | Key exchange, digital signatures |
| ECC | Asymmetric encryption | 256 bit and up | Secure (short keys) | Mobile and TLS, high efficiency |
| TOTP | One-time password | 6-8 digits | Secure (short-lived) | Two-factor authentication |
| CRC32 | Checksum | 32 bit | Not cryptographic | Transfer integrity checks |
| Base64 | Encoding (not crypto) | Variable | Not cryptographic | Binary to text transport |
Frequently Asked Questions
Is MD5 still safe to use?
Not for any security purpose: MD5 collisions can be crafted deliberately, allowing forged signatures and certificates. It is acceptable only for non-adversarial integrity checks (e.g. verifying a download). For security, use SHA-256 or stronger.
Which algorithm should I use to store passwords?
Always use a dedicated password-hashing function, in this order of preference: Argon2 (modern default) > scrypt > bcrypt > PBKDF2. Never store passwords with fast hashes like MD5, SHA-1 or SHA-256, even salted, because they are cheap to brute-force on GPUs. Let a mature library handle salting and the cost parameter.
What is the difference between hashing and encryption?
Hashing is one-way: any input maps to a fixed-length digest that cannot be reversed, used for integrity checks and password storage. Encryption is two-way: a key turns plaintext into ciphertext and back, used to keep data confidential in transit or at rest. Base64 is merely an encoding and is neither.
Should I choose SHA-256 or SHA-3?
Default to SHA-256: it has the best performance, ecosystem support and hardware acceleration. SHA-3 uses a completely different internal construction, making it a good diversification fallback if SHA-2 is ever weakened. Both are currently considered secure.