Both SHA-256 and MD5 are hash functions: they take an input of any size and produce a fixed-length output, deterministically, so the same input always produces the same hash. That is where the similarity ends. One of them is still perfectly reasonable to use today. The other should not be anywhere near a security-sensitive system, and the reason why comes down to a single, well-documented weakness.
A hash collision happens when two different inputs produce the same hash output. Every hash function has collisions in theory, since there are infinitely many possible inputs mapping to a fixed-size output space, but a secure hash function makes finding one computationally infeasible. MD5 fails this test. Practical collision attacks against MD5 have existed since the mid-2000s, and modern hardware can find a colliding pair in seconds. That means an attacker can construct two different files, or two different messages, that hash to the identical MD5 value, which breaks any system that relies on MD5 to prove two things are different or to verify that a file has not been tampered with.
If MD5 is protecting anything an attacker has a reason to forge, it is a real problem. Digital signatures, certificate validation, and password storage are the clearest examples: in each case, someone with the ability to engineer a collision could substitute a malicious file or value for a legitimate one while keeping the same hash, defeating the entire point of the check.
MD5's weakness is specifically about an adversary deliberately engineering a collision. It says nothing about accidental corruption. If you are checking whether a large file downloaded correctly, or deduplicating non-sensitive data where nobody has a motive to forge a match, MD5 still works fine and is faster to compute than SHA-256. The distinction that matters is whether anyone benefits from constructing a collision on purpose. If the answer is no, MD5's weakness is irrelevant to that use case.
SHA-256, part of the SHA-2 family, has no known practical collision attack. It is widely used for digital signatures, TLS certificates, blockchain systems, and general data integrity checks, and remains the standard recommendation for any case where MD5 would be a mistake. It is worth being clear about one thing SHA-256 is not designed for, though: password storage. SHA-256 is a fast, general-purpose hash, which is exactly the wrong property for passwords, since fast hashing lets an attacker try billions of guesses per second against a stolen password database. Purpose-built, deliberately slow algorithms like bcrypt or Argon2 exist specifically to close that gap.
The Encrypt / Decrypt tool on this site supports both SHA-256 and MD5 hashing side by side, with a legacy warning shown automatically whenever MD5 or SHA-1 is selected, so the distinction is visible in the interface rather than something you have to remember on your own.