The basic shape
SHA-256 (part of the SHA-2 family, published by NIST in 2001) takes input of any length and produces a fixed 256-bit (32-byte, typically shown as 64 hex characters) digest. Internally, it processes the input in 512-bit blocks through 64 rounds of bitwise operations (rotations, XORs, modular additions) using a set of 8 working variables initialized from fixed constants — the specific details matter less than the outcome: a small, deterministic change anywhere in the input cascades through every round, producing a completely different final digest (the avalanche effect).
SHA-256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-256("hellO") = 3b6b8dcb4a5f8bcbb0e18cb0968e14d7... (completely different, one letter changed)
Why it's still considered secure
Unlike MD5 and SHA-1, no practical collision attack against SHA-256 is known — finding two different inputs that hash to the same digest remains computationally infeasible with current techniques and hardware. This is why SHA-256 remains the default choice for integrity verification, certificate fingerprints, and blockchain applications (it's the hash function underlying Bitcoin's proof-of-work, for instance) where MD5 and SHA-1 have both been formally deprecated.
Where it actually shows up
- File integrity checks — software downloads publish a SHA-256 checksum so you can verify the file wasn't corrupted or tampered with in transit.
- TLS certificates — modern certificate signatures use SHA-256 (SHA-1-signed certificates are rejected by modern browsers).
- Git — newer Git repositories support SHA-256 object hashing (though SHA-1 remains Git's historical default, itself a separate, narrower story about Git's specific collision-resistance requirements).
- Password storage — notably, not directly. SHA-256 alone is unsuitable for hashing passwords (see Password Hashing) because it's deliberately fast, which helps an attacker brute-force guesses, not the defender.
Common mistakes
- Using SHA-256 directly for password hashing. Its speed is a feature for file integrity checks and a liability for password storage — use bcrypt, scrypt, or Argon2 instead.
- Assuming "SHA-256" and "SHA-2" are different things. SHA-256 is one specific member of the SHA-2 family (alongside SHA-224, SHA-384, SHA-512) — the "256" refers to output size in bits.
- Treating a matching SHA-256 checksum as proof of anything beyond integrity. It confirms the file matches what the checksum was generated from — it says nothing about whether the original source was trustworthy to begin with.
FAQ
Is SHA-256 the same as SHA-2?
SHA-256 is one specific algorithm within the SHA-2 family; SHA-2 also includes SHA-224, SHA-384, and SHA-512 at different output sizes.
Has SHA-256 ever been broken?
No practical collision attack is currently known — it remains the recommended standard for integrity and signature use, unlike its predecessors MD5 and SHA-1.
Why shouldn't I use SHA-256 for storing passwords?
It's designed to be fast, which is exactly the wrong property for password storage — a fast hash lets an attacker try billions of guesses per second; use a deliberately slow algorithm like bcrypt or Argon2 instead.
Generate and verify SHA-256 digests instantly with the Hash Generator — computed entirely in your browser.