Hash Function Benchmark
Which hash function is fastest in practice? We ran a real Node.js benchmark using the crypto module, hashing 1,000 iterations at each of four input sizes (1KB, 10KB, 100KB, 1MB) across five algorithms. The surprising result: SHA-256 is 4.5x faster than MD5 on modern hardware thanks to CPU-level SHA acceleration (SHA-NI instructions).
All benchmarks were run on April 11, 2026 using Node.js with the native crypto.createHash() API, which delegates to OpenSSL and takes advantage of hardware acceleration when available.
Benchmark Results by Input Size
| Input Size | Algorithm | Avg Time (ms) | Throughput (MB/s) | Relative Speed |
|---|---|---|---|---|
| 1 KB | SHA-384 | 0.0011 | 928.7 | Fastest |
| 1 KB | SHA-1 | 0.0012 | 813.4 | 1.14x |
| 1 KB | SHA-256 | 0.0014 | 689.4 | 1.35x |
| 1 KB | SHA-512 | 0.0018 | 532.1 | 1.75x |
| 1 KB | MD5 | 0.0022 | 445.1 | 2.09x |
| 10 KB | SHA-1 | 0.0039 | 2,499.7 | Fastest |
| 10 KB | SHA-256 | 0.0039 | 2,489.0 | 1.00x |
| 10 KB | SHA-384 | 0.0065 | 1,504.5 | 1.66x |
| 10 KB | SHA-512 | 0.0066 | 1,485.4 | 1.68x |
| 10 KB | MD5 | 0.0171 | 570.4 | 4.38x |
| 100 KB | SHA-1 | 0.0363 | 2,688.9 | Fastest |
| 100 KB | SHA-256 | 0.0365 | 2,676.3 | 1.00x |
| 100 KB | SHA-384 | 0.0617 | 1,581.9 | 1.70x |
| 100 KB | SHA-512 | 0.0618 | 1,581.4 | 1.70x |
| 100 KB | MD5 | 0.1619 | 603.2 | 4.46x |
| 1 MB | SHA-1 | 0.3686 | 2,713.2 | Fastest |
| 1 MB | SHA-256 | 0.3691 | 2,709.3 | 1.00x |
| 1 MB | SHA-384 | 0.6296 | 1,588.4 | 1.71x |
| 1 MB | SHA-512 | 0.6308 | 1,585.3 | 1.71x |
| 1 MB | MD5 | 1.6528 | 605.0 | 4.48x |
Algorithm Comparison
| Algorithm | Output Size | Block Size | Security Status | HW Accel | Use Case |
|---|---|---|---|---|---|
| SHA-256 | 256 bits (32 bytes) | 512 bits | Secure | SHA-NI (Intel/AMD) | General purpose, TLS, Bitcoin |
| SHA-512 | 512 bits (64 bytes) | 1024 bits | Secure | Limited | High-security, large data |
| SHA-384 | 384 bits (48 bytes) | 1024 bits | Secure | Uses SHA-512 internals | TLS 1.2/1.3 cipher suites |
| SHA-1 | 160 bits (20 bytes) | 512 bits | Broken (collisions) | SHA-NI (Intel/AMD) | Legacy only, git (migrating) |
| MD5 | 128 bits (16 bytes) | 512 bits | Broken (collisions) | No | Checksums only, never security |
Methodology
Benchmark details:
- Runtime — Node.js using native
crypto.createHash()which delegates to OpenSSL - Iterations — 1,000 iterations per algorithm per input size, reporting average time
- Timing —
performance.now()for sub-millisecond accuracy - Input —
Buffer.alloc(bytes, 'a')for each size (1KB, 10KB, 100KB, 1MB) - Output — Full hex digest generated each iteration
- Hardware — Apple Silicon with hardware SHA acceleration via OpenSSL
Results will vary by CPU architecture. Intel/AMD CPUs with SHA-NI show similar SHA-256 acceleration. Older CPUs without SHA instructions will see MD5 outperform SHA-256.
Frequently Asked Questions
Is SHA-256 faster than MD5?
Yes, on modern hardware with SHA acceleration, SHA-256 is 4.5x faster than MD5. Our benchmark shows SHA-256 at 2,709 MB/s versus MD5 at 605 MB/s for 1MB input. Modern CPUs have dedicated SHA-256 instructions (Intel SHA-NI, ARM SHA2) that MD5 lacks. On older hardware without SHA acceleration, MD5 may still be faster.
Which hash function should I use in 2026?
For security (signatures, integrity): SHA-256 or SHA-512. For passwords: never use SHA/MD5 — use bcrypt, scrypt, or Argon2. For checksums: SHA-256 is recommended since it is faster than MD5 on modern hardware. MD5 and SHA-1 are cryptographically broken and should not be used for any security purpose.
Why is SHA-1 faster than SHA-512 in this benchmark?
SHA-1 operates on 32-bit words with simpler rounds, while SHA-512 uses 64-bit words with higher per-round cost. SHA-1 also benefits from hardware acceleration (SHA-NI on Intel) similar to SHA-256. At large input sizes, SHA-1 and SHA-256 achieve ~2,700 MB/s while SHA-512 peaks at ~1,585 MB/s.
How does input size affect hash function performance?
Throughput increases with input size because per-call overhead is amortized. SHA-256 goes from 689 MB/s at 1KB to 2,709 MB/s at 1MB — a 3.9x improvement. For small inputs like API tokens, per-call overhead dominates; for large files, raw throughput matters.
Is Blake3 faster than SHA-256?
Blake3 is typically 5-10x faster than SHA-256 in software implementations due to its parallelizable tree structure. However, with hardware SHA acceleration (SHA-NI), the gap narrows to 2-3x. Blake3 is not yet available in Node.js crypto natively — you need the blake3 npm package.
Free to use under CC BY 4.0 license. Cite this page when sharing.