Hash function security summary


This article summarizes publicly known attacks against cryptographic hash functions. Note that not all entries may be up to date. For a summary of other hash function parameters, see comparison of cryptographic hash functions.

Table color key

Common hash functions

Collision resistance

Hash functionSecurity claimBest attackPublish dateComment
MD5264218 time2013-03-25This attack takes seconds on a regular PC. Two-block collisions in 218, single-block collisions in 241.
SHA-1280261.22020-01-08Paper by Gaëtan Leurent and Thomas Peyrin
SHA256212831 of 64 rounds 2013-05-28Two-block collision.
SHA512225624 of 80 rounds 2008-11-25Paper.
SHA-3Up to 25126 of 24 rounds 2017Paper.
BLAKE2s21282.5 of 10 rounds 2009-05-26Paper.
BLAKE2b22562.5 of 12 rounds 2009-05-26Paper.

Chosen prefix collision attack

Hash functionSecurity claimBest attackPublish dateComment
MD52642392009-06-16This attack takes hours on a regular PC.
SHA-1280263.42020-01-08Paper by Gaëtan Leurent and Thomas Peyrin
SHA2562128
SHA5122256
SHA-3Up to 2512
BLAKE2s2128
BLAKE2b2256

Preimage resistance

Hash functionSecurity claimBest attackPublish dateComment
MD521282123.42009-04-27Paper.
SHA-1216045 of 80 rounds2008-08-17Paper.
SHA256225643 of 64 rounds 2009-12-10Paper.
SHA512251246 of 80 rounds 2008-11-25Paper, updated version.
SHA-3Up to 2512
BLAKE2s22562.5 of 10 rounds 2009-05-26Paper.
BLAKE2b25122.5 of 12 rounds 2009-05-26Paper.

Length extension

  • Vulnerable: MD5, SHA1, SHA256, SHA512
  • Not vulnerable: SHA384, SHA-3, BLAKE2

    Less-common hash functions

Collision resistance

Hash functionSecurity claimBest attackPublish dateComment
GOST212821052008-08-18Paper.
HAVAL-128264272004-08-17Collisions originally reported in 2004, followed up by cryptanalysis paper in 2005.
MD22642009Slightly less computationally expensive than a birthday attack, but for practical purposes, memory requirements make it more expensive.
MD42643 operations2007-03-22Finding collisions almost as fast as verifying them.
PANAMA2128262007-04-04Paper, improvement of an earlier theoretical attack from 2001.
RIPEMD 264218 time2004-08-17Collisions originally reported in 2004, followed up by cryptanalysis paper in 2005.
RadioGatúnUp to 260827042008-12-04For a word size w between 1-64 bits, the hash provides a security claim of 29.5w. The attack can find a collision in 211w time.
RIPEMD-16028048 of 80 rounds 2006Paper.
SHA-0280233.6 time2008-02-11Two-block collisions using boomerang attack. Attack takes estimated 1 hour on an average PC.
Streebog22569.5 rounds of 12 2013-09-10Rebound attack.
Whirlpool22564.5 of 10 rounds 2009-02-24Rebound attack.

Preimage resistance

Hash functionSecurity claimBest attackPublish dateComment
GOST225621922008-08-18Paper.
MD22128273 time, 273 memory2008Paper.
MD421282102 time, 233 memory2008-02-10Paper.
RIPEMD 212835 of 48 rounds2011Paper.
RIPEMD-128212835 of 64 rounds2011Paper.
RIPEMD-160216031 of 80 rounds2011Paper.
Streebog25122266 time, 2259 data2014-08-29The paper presents two second-preimage attacks with variable data requirements.
Tiger21922188.8 time, 28 memory2010-12-06Paper.

Attacks on hashed passwords

Hashes described here are designed for fast computation and have roughly similar speeds. Because most users typically choose short passwords formed in predictable ways, passwords can often be recovered from their hashed value if a fast hash is used. Searches on the order of 100 billion tests per second are possible with high-end graphics processors.
Special hashes called key derivation functions have been created to slow brute force searches. These include pbkdf2, bcrypt, scrypt, argon2, and balloon.