MD5: 128-bit, fast, INSECURE
SHA-256: 256-bit, fast, SECURE
Use SHA-256 for:
✓ Passwords (with salt)
✓ File integrity
✓ Digital signatures
MD5 ok for:
✓ Non-security checksums
✓ ETags
Only for non-security purposes like checksums, ETags, or when backward compatibility is required. Never for passwords or signatures.