SHA-256 is one of the most widely used algorithms in the world. It secures HTTPS connections, verifies software downloads, backs every Bitcoin transaction, and protects code signing for operating systems. Yet most people have never heard of it. This guide explains what SHA-256 is, how it produces its distinctive 64-character output, and why it matters for your security.
What is SHA-256?
SHA-256 is a cryptographic hash function. Given any input — a password, a file, a sentence, or an entire hard drive — it produces a fixed 256-bit (64 hexadecimal character) output called a digest or hash.
SHA stands for Secure Hash Algorithm. The -256 refers to the output length in bits. SHA-256 is part of the SHA-2 family, designed by the NSA and published by NIST (the U.S. National Institute of Standards and Technology) in 2001.
SHA-256 of "hello":
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-256 of "hello " (added one space):
e02aa1b106d5c7c6a98def2b13005d5b84fd8dc8d2728d4457f2f55db0b93e23
One space changes every single character of the output — this is the avalanche effect.
Three properties that make it useful
SHA-256 has three fundamental properties that make it useful for security:
- Deterministic — The same input always produces the same 64-character output. This allows you to verify a file or password by comparing hashes without storing the original.
- One-way (preimage resistance) — You can compute a hash from input in milliseconds, but reversing a hash to find the original input is computationally infeasible. There is no "undo" button.
- Collision resistant — It is computationally infeasible to find two different inputs that produce the same hash. SHA-256 has no known collisions.
How SHA-256 actually works (simplified)
The algorithm transforms your input through a series of mathematical operations:
- Padding — The input is padded so its length is 448 bits mod 512, then a 64-bit representation of the original length is appended. This ensures the total length is a multiple of 512 bits.
- Parsing — The padded input is split into 512-bit (64-byte) blocks.
- Expansion — Each 512-bit block is expanded into a 64-word message schedule using bitwise operations (rotations, shifts, XOR).
- Compression — The message schedule is processed through 64 rounds of mixing using 8 working variables and 64 round constants. Each round applies four nonlinear functions and modular addition.
- Output — The final values of the 8 working variables are concatenated to produce the 256-bit (32-byte) digest.
The mathematics make it effectively impossible to work backwards through these rounds to recover the input — or to construct a different input that produces the same output.
Reading a SHA-256 hash
A SHA-256 hash is always exactly 64 hexadecimal characters. Each hex character represents 4 bits, so 64 × 4 = 256 bits total. The output looks random regardless of the input's length or content:
Input: "a"
ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb
Input: "The quick brown fox jumps over the lazy dog"
d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
Both outputs: always exactly 64 hex chars
Where SHA-256 is used
TLS/HTTPS
Every HTTPS connection uses SHA-256 in certificate fingerprints and during the handshake to verify server identity.
Bitcoin
Bitcoin uses double SHA-256 (SHA-256 applied twice) for transaction hashing and proof-of-work mining.
Code signing
macOS and Windows verify software signatures using SHA-256 to ensure installers haven't been tampered with.
Git
Git uses SHA-256 (since Git 2.29) to identify every commit, file, and tree object in a repository.
File integrity
Download pages publish SHA-256 checksums so you can verify a file wasn't corrupted or tampered with in transit.
HMAC tokens
API authentication often uses HMAC-SHA-256 to sign requests, proving they came from a legitimate client.
SHA-256 vs SHA-512 vs SHA-1 vs MD5
| Algorithm | Output | Status | Use for |
|---|---|---|---|
| SHA-256 | 64 hex chars | ✅ Secure | General purpose — most common choice |
| SHA-512 | 128 hex chars | ✅ Secure | High security; faster on 64-bit hardware |
| SHA-1 | 40 hex chars | ⚠️ Deprecated | Legacy systems only |
| MD5 | 32 hex chars | ❌ Broken | Non-security checksums only |
Why you should NOT use SHA-256 directly for passwords
SHA-256 is extremely fast — a modern GPU can compute billions of SHA-256 hashes per second. This speed is great for verifying file integrity, but it's catastrophic for password storage. An attacker with a hacked database can try billions of passwords per second until they find one that produces a matching hash.
For storing passwords, use purpose-built password hashing functions designed to be intentionally slow:
- bcrypt — adjustable work factor, still the most widely deployed
- Argon2id — winner of the 2015 Password Hashing Competition, memory-hard
- scrypt — memory and CPU intensive, used in Litecoin
SHA-256 is for data integrity and authentication — not for storing passwords. Modern frameworks handle this automatically if you use their built-in auth libraries.
Try SHA-256 yourself
Our free Hash Generator computes SHA-256 (and MD5, SHA-1, SHA-512) directly in your browser using the Web Crypto API. Your text is never sent to any server.
Frequently asked questions
Has SHA-256 ever been broken?
No. As of 2026, there are no known collisions, preimage attacks, or practical weaknesses in SHA-256. It remains the recommended standard for general cryptographic use and is considered secure against both classical and near-term quantum computers.
Can quantum computers break SHA-256?
Grover's algorithm allows quantum computers to search a hash space in O(√N) operations instead of O(N), which effectively halves the security of SHA-256 from 256 bits to 128 bits. 128 bits of security is still considered safe — quantum computers would need to be trillions of times more powerful than today's machines to be a practical threat to SHA-256.
What's the difference between SHA-2 and SHA-256?
SHA-2 is the family name for a set of algorithms: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. SHA-256 is the most commonly used member of the SHA-2 family. SHA-3 is a separate family (using a different construction called Keccak) standardized in 2015 as an alternative.
Why does Bitcoin use double SHA-256?
Bitcoin's creator Satoshi Nakamoto applied SHA-256 twice (SHA-256 of SHA-256) as an extra precaution against potential length-extension attacks, which affect some SHA-2 variants. It also doubled the work factor slightly. The design predates common use of HMAC, which is the more standard defense against length-extension attacks today.