Create a newMessageDigest instance each time you need one.
All of the instances returned from getInstance() are distinct. They need to be, as they maintain separate digests (and if that’s not enough for you, here’s a link to the source).
ThreadLocal can provide a performance benefit when used with a threadpool, to maintain expensive-to-construct objects. MessageDigest isn’t particularly expensive to construct (again, look at the source).