SHA-256 is a cryptographic hash function from the SHA-2 family that transforms an input of any length into a fixed 256-bit digest, usually written as 64 hexadecimal characters. In cryptography it serves as a digital fingerprint: the same input always yields the same digest, while even a one-bit change produces a completely different result.
Designed by the US National Security Agency and standardized by NIST in FIPS 180-4, SHA-256 is today the most widely used general-purpose hash. It underpins TLS certificate signatures, software and file integrity checks, HMAC message authentication, blockchain proof of work and many key derivation schemes, and no practical attack against its collision or preimage resistance is known.
How SHA-256 processes data
SHA-256 follows the Merkle-Damgard construction. The message is padded with a single 1 bit, enough zero bits and a 64-bit length field so that its total length becomes a multiple of 512 bits. It is then split into 512-bit blocks that are fed one by one into a compression function that updates a 256-bit internal state.
Each compression call expands the block into 64 words of 32 bits through the message schedule, then runs 64 rounds that mix the eight state words with modular addition, bitwise rotations, shifts and the nonlinear Ch and Maj functions. The initial state values come from the fractional parts of the square roots of the first eight primes, and the 64 round constants from the cube roots of the first 64 primes, a choice meant to show that no hidden structure was built in.
| Parameter | Value | Significance |
|---|---|---|
| Digest size | 256 bits (32 bytes) | Sets the security level |
| Block size | 512 bits (64 bytes) | Unit processed per compression call |
| Word size | 32 bits | Efficient on 32-bit and 64-bit CPUs |
| Rounds | 64 | Provides diffusion and security margin |
| Maximum message length | 2^64 – 1 bits | Practically unlimited |
| Internal state | Eight 32-bit words | Equals the final digest size |
Security properties and their strength
A cryptographic hash must resist three kinds of attack. SHA-256 provides the generic security levels expected of a 256-bit hash, and the best published cryptanalysis reaches only reduced-round versions, leaving a comfortable margin against the full 64 rounds.
| Property | Attacker goal | Generic cost |
|---|---|---|
| Preimage resistance | Find any input for a given digest | About 2^256 operations |
| Second-preimage resistance | Find a different input with the same digest as a given one | About 2^256 operations |
| Collision resistance | Find any two inputs with the same digest | About 2^128 operations |
The collision figure follows from the birthday bound: with an n-bit digest, collisions appear after roughly 2^(n/2) attempts. For quantum computers, Grover’s algorithm would reduce preimage search to roughly 2^128, which is still considered secure, so SHA-256 is generally regarded as suitable for the post-quantum era at a 128-bit security level.
SHA-256 compared with other hash functions
SHA-256 sits between broken legacy hashes and newer designs. Choosing among them depends on security requirements, performance and compatibility with protocols that mandate a specific function.
| Hash function | Digest size | Status and notes |
|---|---|---|
| MD5 | 128 bits | Broken; practical collisions, never use for security |
| SHA-1 | 160 bits | Broken; public collision demonstrated in 2017 |
| SHA-256 | 256 bits | Secure; default choice in most protocols |
| SHA-512 | 512 bits | Secure; often faster on 64-bit CPUs without hardware support |
| SHA-3-256 | 256 bits | Secure; sponge design, immune to length extension |
| BLAKE3 | 256 bits by default | Secure; very fast and parallel, less standardized |
On modern processors with SHA hardware extensions, such as Intel SHA-NI and the ARMv8 cryptography extensions, SHA-256 reaches throughput of roughly one to several gigabytes per second per core, which removes most of its historical speed disadvantage.
Where SHA-256 is used
Because it is standardized, fast and trusted, SHA-256 appears throughout security infrastructure, often in roles that users never see. Neighboring Terms such as the digital signature and the hash function describe the broader concepts that these applications rely on.
- Digital signatures: certificates and signed software are hashed with SHA-256 before RSA or ECDSA signing.
- HMAC-SHA256: message authentication in APIs, JSON Web Tokens with HS256 and the TLS key schedule through HKDF.
- Integrity verification: download checksums, package manager metadata and container image digests.
- Content addressing: Git’s SHA-256 object format and many storage systems identify data by its digest.
- Blockchains: Bitcoin applies SHA-256 twice in its proof of work and in transaction identifiers.
Pitfalls when using SHA-256
SHA-256 itself is strong, yet it is frequently misapplied. The most damaging mistakes come from using a fast general-purpose hash where a specialized construction is required.
| Misuse | Problem | Correct approach |
|---|---|---|
| Hashing passwords with plain SHA-256 | Billions of guesses per second on GPUs | Argon2id, scrypt or bcrypt |
| MAC as hash(key + message) | Vulnerable to length extension | HMAC-SHA256 |
| Truncating digests carelessly | Lowers collision resistance | Keep at least 128 bits, ideally full length |
| Checksum from the same source as the file | Attacker replaces both | Verify a signed checksum or signature |
The length extension property deserves attention: given SHA-256(secret || message) and the length of the secret, an attacker can compute the hash of a longer message without knowing the secret. HMAC and SHA-3 avoid this weakness by design.
Another subtle point is that a digest proves integrity only relative to a trusted reference value. Comparing a computed digest with one fetched over the same untrusted channel proves nothing, and comparisons of secret values such as HMAC tags should use a constant-time comparison so that response timing does not reveal how many leading bytes matched.
Put simply
SHA-256 works like a fingerprint machine for data. Feed it a sentence, a photo or an entire hard disk image, and it produces a short code of 64 characters. The same data always gets the same code, but changing even a single letter produces a completely different one.
Nobody can run the machine backward to recover the data from the code, and nobody has found two different inputs with the same code. That is why computers use it to check that files have not been altered and to seal digital signatures.
In practice
A software company distributes an installer of about 300 MB to customers. Its build pipeline computes the SHA-256 digest of the final file and signs a small manifest containing that digest with the company’s code-signing key. The customer’s update tool downloads both, verifies the signature on the manifest and then recomputes the digest of the installer, which takes well under a second.
During one release, a compromised mirror server delivers a modified installer. The recomputed digest does not match the signed value, so the update tool refuses to run the file and reports the mismatch, and the company traces the problem to the mirror before any customer system is affected.