JavaScript hashing speed comparison: MD5 versus SHA-256
Hashing algorithms convert input data into a fixed-size string of characters, known as a hash value or digest. These algorithms are one-way functions, meaning the original data cannot be feasibly retrieved from the hash, which makes them useful for data integrity, password storage, and digital signatures. MD5 and SHA-256 are two such hashing algorithms with significant differences in security, speed, and application. MD5 is older and often said to faster hashing due to its simpler structure. MD5 is now considered cryptographically broken. SHA-256 provides a higher level of security with its 256-bit hash output.
But is MD5 really faster? I decided to write a little JavaScript program to hash a large input using both MD5 and SHA-256. My JavaScript code defines two functions for hashing: md5Hash uses the MD5 algorithm to produce a 128-bit hash, while sha256Hash employs SHA-256 for a more secure. A large 1GB array, created by createRandomUint8Array, is then used to benchmark these hashing functions.
function md5Hash(message) {
return crypto.createHash('md5').update(message).digest('hex');
}
function sha256Hash(message) {
return crypto.createHash('sha256').update(message).digest('hex');
}
const largeString = createRandomUint8Array(1000000000); // 1GB string
bench('MD5 Hash', () => {
md5Hash(largeString);
});
bench('SHA-256 Hash', () => {
sha256Hash(largeString);
});
I use the latest version of the Bun runtime and Node.js 23 in my tests. In find that on a ARM systems (Apple M2 or Amazon Graviton 4), Bun is slightly faster on the MD5 benchmark, but both Node.js and Bun have otherwise identical speeds.
My results suggest that you should probably not be using MD5. MD5 is slower than SHA-256 and not as safe.
Even though SHA-256 looks more expensive on paper, modern processors typically have cryptographic extensions to accelerate it.