Three properties matter: preimage resistance (given a digest, find any input), second-preimage resistance (given an input, find another with the same digest) and collision resistance (find any two inputs that collide). For an n-bit digest the generic costs are about 2ⁿ, 2ⁿ and 2ⁿᐟ², the last because of the birthday paradox, which is why SHA-256 gives 128-bit collision resistance.
Standard functions: SHA-2 (SHA-224 to SHA-512, FIPS 180-4) and SHA-3 with the SHAKE extendable-output functions (FIPS 202) are approved; BLAKE2 (RFC 7693) is widely used outside NIST contexts; MD5 and SHA-1 are broken for collisions and must not be used where an attacker can choose inputs. Merkle–Damgård designs (MD5, SHA-1, SHA-2) allow length extension; sponges (SHA-3) and HAIFA designs (BLAKE2) do not.
A hash is not a MAC, not a password hash and not encryption: use HMAC or KMAC for keyed integrity, Argon2id, scrypt or PBKDF2 for passwords, and an AEAD for confidentiality. Quantum computers barely affect hashes: Grover's algorithm gives at most a square-root speed-up for preimages, and NIST's draft transition plan keeps SHA-256 and SHA-3 in service.