---
title: Avoid broken or weak cryptographic hash algorithms
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Avoid broken or weak cryptographic hash algorithms
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Avoid broken or weak cryptographic hash algorithms

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `dart-security/weak-hash-algorithm`

**Language:** Dart

**Severity:** Warning

**Category:** Security

**CWE**: [327](https://cwe.mitre.org/data/definitions/327.html)

**Related CWEs**:

- [328](https://cwe.mitre.org/data/definitions/328.html)
- [916](https://cwe.mitre.org/data/definitions/916.html)
- [1240](https://cwe.mitre.org/data/definitions/1240.html)

## Description{% #description %}

MD5 and SHA-1 are cryptographically broken and collision-prone. Using them for digital signatures, data integrity checks, or message authentication provides no real security guarantee.

Replace them with SHA-256 or stronger (`sha256`, `sha512` from the `crypto` package). MD5 and SHA-1 are only acceptable for non-security purposes such as cache keys or non-security checksums where collision resistance is irrelevant.

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```dart
import 'package:crypto/crypto.dart';
import 'dart:convert';

String checksumForSecurity(String input) {
  final digest = md5.convert(utf8.encode(input));
  return digest.toString();
}
```

```dart
import 'package:crypto/crypto.dart';
import 'dart:convert';

String signData(List<int> data) {
  return sha1.convert(data).toString();
}
```

```dart
import 'package:crypto/crypto.dart';
import 'dart:convert';

void processData(List<int> data) {
  final h1 = md5.convert(data);
  final h2 = sha1.convert(data);
}
```

## Compliant Code Examples{% #compliant-code-examples %}

```dart
import 'package:crypto/crypto.dart';
import 'dart:convert';

String hashData(String input) {
  final digest = sha256.convert(utf8.encode(input));
  return digest.toString();
}
```

```dart
import 'package:crypto/crypto.dart';
import 'dart:convert';

String hashData(List<int> data) {
  return sha512.convert(data).toString();
}
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}