MD5 vs SHA-1 vs SHA-256

Use SHA-256. MD5 (128-bit) and SHA-1 (160-bit) are both broken for security: practical collisions, two different inputs with the same hash, were published for MD5 in 2004 and for SHA-1 in 2017. They're still fine as quick checksums against accidental corruption, and both survive in older systems, but anything that relies on collision resistance, such as signatures and certificates, needs SHA-256 or newer.

A collision means two different inputs with the same hash, and for a function meant to fingerprint data, that's fatal: someone could get one document signed and swap in another. In August 2004 Xiaoyun Wang and colleagues announced collisions for full MD5, and the attacks only got cheaper. On 23 February 2017 the SHAttered project published two different PDF files with the same SHA-1 hash.

Git is the best-known SHA-1 user. Since version 2.13 it has used a hardened SHA-1 that isn't vulnerable to the SHAttered attack, and it can create repositories that use SHA-256 instead, though SHA-1 is still the default.

None of the three. They're all designed to be fast, and fast is what an attacker guessing passwords wants. Password storage needs a slow, salted function. Hashing vs encryption explains why.