hashlib md5 vs blake2b: Checksum Lab

Intro — what this post promises

Content checksums: how do hashlib.md5, sha1, blake2b, and sha256 compare on MB/s for integrity hashing? This is a throughput lab, not crypto advice — MD5/SHA-1 are broken for collision resistance and appear here only as legacy checksum baselines.

Related links:

• 01shoppercove.comSHA-256 vs BLAKE2 vs xxHash localhost lab
• 02shoppercove.comglob vs rglob vs walk localhost lab
• 03shoppercove.comshutil copyfile vs manual localhost lab
• 04shoppercove.combytes vs bytearray localhost lab
• 05shoppercove.comjson dumps compact vs indent localhost lab
• 06shoppercove.comstr translate vs replace localhost lab
• 07shoppercove.comsetdefault vs defaultdict localhost lab
• 08shoppercove.comperf_counter vs time localhost lab

Lab honesty (1 Oct 2026 IST): Python 3.13.5; OpenSSL 3.5.7 9 Jun 2026. Stdlib hashlib only (no xxhash — that was lab 35). Affiliates: 0. OpenSSL may accelerate SHA-2 heavily on this CPU.

Verdict up front (16 MiB oneshot): sha256 ~1468 MB/s, sha1 ~1320, md5 ~664, blake2b ~500. md5÷sha256 ~0.45×; blake2b÷sha256 ~0.34×. On this OpenSSL build, SHA-256 outran MD5 — measure your box before assuming “MD5 is the fast checksum.”

Arms

Lab topology

buffers: 64KiB / 1MiB / 16MiB os.urandom
chunked: 16×1MiB updates; many-small: 20000×1KiB
metric: p50 MB/s

Script: lab-evidence/77-hashlib-md5-vs-blake2b/results/run_lab.py.

Lead table — oneshot 16 MiB (p50)

Chunked 16 MiB & many 1 KiB

Chunking ≈ oneshot for md5/sha256 here (~1.01× / ~1.01×). Many small digests shift rankings (constructor overhead) — blake2b closed on sha256 (~0.64×).

Reading it

• Do not assume MD5 is the throughput king — with OpenSSL SHA-NI-style acceleration, sha256 won the large-buffer race on this host.
• BLAKE2b default (64-byte digest) was slower than sha256 for big oneshots; digest_size=32 helped some sizes.
• Lab 35 already covered xxHash vs blake2/sha256 for non-crypto fingerprinting — use that when you need non-cryptographic ultra-speed; this lab stays on hashlib checksums.
• Integrity ≠ security — for passwords/signatures use modern KDFs / SHA-2+/SHA-3 as policy requires; this post only ranks digest speed.

OpenSSL can invert folklore

Many engineers still assume “MD5 is the cheap checksum.” On this host’s OpenSSL build, SHA-256 oneshot throughput beat MD5 by roughly 2× on a 16 MiB buffer. Hardware SHA extensions and library optimizations matter more than textbook relative costs from the 1990s. Always bench the digests you ship in an integrity pipeline.

Pitfalls

1. Choosing MD5 “because it’s fast” without measuring — may be false on modern OpenSSL.
2. Using MD5/SHA-1 for security — collision attacks; don’t.
3. Ignoring many-small vs bulk — API overhead changes winners.
4. Comparing to xxhash without saying so — different tool class (see lab 35).

When to pick what

Reproduce

python3 lab-evidence/77-hashlib-md5-vs-blake2b/results/run_lab.py

Evidence: /workspace/lab-evidence/77-hashlib-md5-vs-blake2b/results/.

Closing

Measure checksums on your OpenSSL; don’t mythologize MD5 speed. On this box 16 MiB sha256 hit ~1468 MB/s, beating md5 (~664, ~0.45×) and default blake2b (~500, ~0.34×). Use these numbers for integrity-pipeline capacity planning — not as a cryptography shortlist.