Not for security. SHA-1 has had a demonstrated collision since February 2017, and CWE-327 lists MD5 and SHA-1 among algorithms once thought strong that can now be broken. For catching accidental corruption they still work, but choose SHA-256 for anything new so you never explain an exception.
What a collision is and why it matters
A hash function turns any input into a fixed-size fingerprint. A collision is two different inputs that produce the same fingerprint. If an attacker can build collisions, a fingerprint stops proving that a file is the one you meant.
On 23 February 2017, researchers at CWI Amsterdam and Google published the first real SHA-1 collision: two visibly different PDF files with the same SHA-1 value. The project page says it took about nine quintillion SHA-1 computations, roughly 6,500 CPU-years plus 110 GPU-years. That is expensive, and it has only become cheaper to approach since.
Where each hash stands
| Use | MD5 | SHA-1 | SHA-256 |
|---|---|---|---|
| Detect accidental corruption | Works | Works | Works |
| Verify a download against a published value | Avoid | Avoid | Use |
| Signatures and certificates | Never | Never for new work | Use |
| Password storage | Never, use a password hash | Never, use a password hash | Not on its own |
The OWASP TLS guidance says certificates should be signed with SHA-256 rather than MD5 or SHA-1. TLS 1.3 describes SHA-1 signature schemes as legacy because of known weaknesses.
The password row deserves a note. Even a strong general hash is the wrong tool there, because it is fast. Use a purpose-built password hash instead.
Why they linger
Old code and old formats keep them alive. Package checksums, cache keys, ETags, legacy APIs and database columns often use MD5 or SHA-1. Many of these are harmless because nobody is trying to forge them. The risk appears when someone reuses the same helper for an integrity or trust decision.
A migration path that does not break things
- Search the code for md5, sha1 and the library calls that wrap them.
- Label each hit: cache key or dedupe (low risk), integrity or trust (fix first), password or token (fix now).
- For integrity and trust, switch to SHA-256 and store the algorithm name next to the digest, for example sha256:abcd. That makes the next change cheap.
- Accept both digests for a short window if clients are slow to update, then remove the old one.
- Add a lint or code scanning rule that flags new uses.
Try it yourself
Open the code scan demo and look at how a weak hash call is reported with its location. Then think about which of your own hits would land in the fix first bucket.
Click through it at your own pace, or open it full screen.
Safeguard can generate an SBOM and scan your dependencies, so outdated cryptography libraries with known advisories show up in one inventory, and policies can gate a build on them. A free scan is at gold.safeguard.sh/scan.
Quick check
Can I use MD5 for a cache key?
Usually yes, if nobody can gain by forcing two inputs to collide. If an attacker controls the inputs and a collision would serve stale or wrong content, use SHA-256.
Does a SHA-1 collision mean every SHA-1 hash can be forged?
No. The demonstrated attack produced two crafted PDF files that share a hash. It is still enough reason to stop trusting SHA-1 for signatures and integrity.
Sources
- SHAttered
- CWE-327: Use of a Broken or Risky Cryptographic Algorithm
- OWASP Transport Layer Security Cheat Sheet
- RFC 8446, TLS 1.3
Last reviewed: 19 October 2026.
