What is SHA-256?
SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function that produces a 256-bit digest. Learn how SHA-256 works, why it's secure, and where it's used.
SHA-256 is a cryptographic hash function from the SHA-2 family, designed by the U.S. National Security Agency (NSA) and published in 2001. It takes any input and produces a fixed 256-bit (32-byte) hash value, expressed as a 64-character hexadecimal string. SHA-256 is currently considered cryptographically secure and is widely used in security-critical applications.
How SHA-256 Works
SHA-256 processes input in 512-bit blocks through 64 rounds of mathematical operations: • "hello" → 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 • "Hello" → 185f8db32921bd46d35b1895a214b3e861c7e0b5d49275e0cfb99d33da37ffb2 • Any change, no matter how small, produces a completely different 64-character hash The avalanche effect makes SHA-256 excellent for detecting tampering.
SHA-256 Security Properties
SHA-256 provides strong security guarantees: • Pre-image resistance — given a hash, you cannot find the original input • Second pre-image resistance — given an input, you cannot find a different input with the same hash • Collision resistance — finding any two inputs that produce the same hash is computationally infeasible • No practical attacks have been demonstrated against SHA-256 as of 2025 • Quantum computers would require ~2^128 operations to break (SHA-256 remains secure)
Where SHA-256 is Used
SHA-256 is foundational to modern security: • Bitcoin — the proof-of-work mining algorithm • TLS/HTTPS — authenticates server certificates • Digital signatures — code signing, document signing • Password hashing — combined with salting (though bcrypt/Argon2 are preferred) • Git — every commit, tree, and blob is identified by a SHA-256 (Git 2.29+) or SHA-1 hash • File integrity — software download checksums
Try it yourself
Generate UUIDAbout SHA-256
SHA-256 is part of the SHA-2 family standardized by NIST (National Institute of Standards and Technology) in FIPS PUB 180-4. It replaced SHA-1, which was found to be vulnerable to collision attacks in 2017. SHA-3, a completely different algorithm, was standardized in 2015 as an alternative, but SHA-256 remains the dominant standard due to its wide adoption and proven security.
FAQ
- What does SHA-256 stand for?
- SHA-256 stands for Secure Hash Algorithm with a 256-bit output. It is part of the SHA-2 family of hash functions.
- What is the difference between SHA-256 and MD5?
- SHA-256 produces a 256-bit (64 hex chars) hash while MD5 produces a 128-bit (32 hex chars) hash. More importantly, SHA-256 is cryptographically secure while MD5 is considered broken due to known collision attacks.
- Can SHA-256 be reversed (decrypted)?
- No. SHA-256 is a one-way function — it is computationally infeasible to reverse a SHA-256 hash to its original input. This is by design and is what makes it useful for security.
Related Tools
Date Calculator
Calculate the difference between two dates in days, weeks, months, and years
Percentage Calculator
Calculate percentages, discounts, increases, and percentage differences
Image Compressor
Compress and resize images to reduce file size while maintaining quality
JSON Formatter
Format and beautify JSON data with syntax highlighting