Hashing is one-way, not encryption. A digest cannot be turned back into the text that produced it — but an attacker with a wordlist can hash guesses until one matches, which is why a short or common input is recoverable in practice even though the hash itself is not reversible.
MD5 and SHA-1 are broken for anything security-related: practical collisions exist for both, so neither should be used for signatures, certificates or integrity you rely on. They remain here because you still meet them in existing systems and checksums. Prefer SHA-256 or above for new work — and for passwords use neither, since a fast hash is the wrong tool entirely.