What Is SHA-256? How Hashing Works

What exactly is SHA-256?

SHA-256 stands for Secure Hash Algorithm 256-bit. It belongs to the SHA-2 family, designed by the U.S. National Security Agency and published by NIST in 2001. A hash function takes data of any size and returns a fixed-size string called a digest, or hash. SHA-256 always returns 256 bits — 64 hex characters — whether the input is empty, three letters, or a 4K video file. There is no key involved, and nothing to decrypt: hashing is a one-way trip.

The output looks random, but it is fully determined: feed in the same bytes and you get the same hash every time, on any machine, in any year. That property, called determinism, is what makes hashes useful as fingerprints. If two files have the same SHA-256 hash, you can be confident they are byte-for-byte identical; if the hashes differ, something changed, even if only one bit flipped somewhere inside.

You can see this for yourself with the hash generator: type any text and watch the 64-character output appear instantly. Hash the same text again tomorrow and the result will be identical, down to the last character.

How does SHA-256 turn text into a hash?

SHA-256 works in three stages: pad the message, split it into blocks, and compress each block through 64 rounds of mixing.

First the input is padded so its length becomes a multiple of 512 bits. A single 1 bit is appended, followed by enough 0 bits, and finally a 64-bit number recording the original message length in bits. A short message is padded to exactly one 512-bit block; a longer message is split into as many 512-bit blocks as it needs.

Each block then passes through the compression function, which runs 64 rounds. Every round mixes the block's data with fixed constants and the running state using bitwise operations — AND, OR, XOR, rotations, and additions modulo 2^32. The state after the last block is the final hash. The design goal is diffusion: every input bit influences many output bits, so the result looks unrelated to the input even though it was computed from it step by step.

That is also why SHA-256 is fast for honest use and hopeless to attack by guessing: hashing a file takes milliseconds, but finding an input that produces a chosen hash means trying, on average, 2^255 candidates — a number far beyond any computer that will ever be built.

Worked example: hashing "abc" step by step

Take the input abc and follow it through the algorithm by hand.

Step 1 — count the bits. The three letters are 3 bytes, or 24 bits. In binary, a is 01100001, b is 01100010, and c is 01100011.

Step 2 — pad to one block. Append a 1 bit, then 423 zero bits, then the 64-bit length field holding the number 24. The total is 24 + 1 + 423 + 64 = 512 bits — exactly one block. Check the arithmetic: 24 + 1 = 25, 25 + 423 = 448, and 448 + 64 = 512.

Step 3 — run the 64 rounds. The block is expanded into 64 words of 32 bits each, and the compression function mixes them into the running state over 64 rounds, using the fixed constants defined in the standard.

Step 4 — read off the digest. The final state, written as hexadecimal, is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad — 64 characters, as always.

Change one letter and the result is unrecognizable: abd hashes to a52d159f262b2c6ddb724a61840befc36eb30c88877a4030b65cbe86298449c9, and even adding a full stop — abc. — gives 5ac9481b887da55cdb508bbb7d91e7896c418c1ad3badb6f4f6d2a524f5cdcaf. The inputs differ by one character; the outputs share no visible pattern. That is the avalanche effect, and it is exactly what a hash function is supposed to do.

The empty string has a hash too: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Every input, including nothing at all, maps to some 64-character value. Try it in the hash generator — paste your own text and compare it with the values here.

What makes SHA-256 secure?

Security for a hash function rests on three properties. Preimage resistance means that given a hash, you cannot find an input that produces it — the only approach is guessing, and the space has 2^256, about 1.16 × 10^77, possibilities. Second preimage resistance means that given one input, you cannot find a different input with the same hash. Collision resistance means you cannot find any two inputs that hash to the same value.

The collision bound comes from the birthday paradox: with a 256-bit output, a collision is expected after roughly 2^128 tries — about 3.4 × 10^38 hashes. At a billion hashes per second, that would still take far longer than the age of the universe. No shortcut is known: unlike MD5 and SHA-1, whose collision attacks are practical today, SHA-256 has no published attack better than brute force.

One caveat matters for passwords. SHA-256 is deliberately fast — a modern graphics card can compute billions of hashes per second — so hashing a password with plain SHA-256 is weak: an attacker can test whole dictionaries in seconds. Passwords need a salt and a slow, memory-hard function such as bcrypt, scrypt, or Argon2, which are built for that job. SHA-256 is the wrong tool for password storage, and the right tool for fingerprints and integrity checks.

SHA-256 vs MD5 vs SHA-1: how do they compare?

MD5 and SHA-1 came first, and both are now broken for security use. The table shows why SHA-256 replaced them.

MD5 and SHA-1 were fine in their day, but both now have practical collision attacks: researchers can craft two different files with the same MD5 or SHA-1 hash. That kills their use for signatures and certificates, where an attacker could swap in a forged file that still verifies. SHA-256 and SHA-512 have no such attack, which is why browsers, certificate authorities, and version control systems have moved to them. SHA-512 is the stronger sibling on paper, but SHA-256 is the common default: its 64-character output is shorter, and 256 bits of security is already far beyond brute force.

Where is SHA-256 actually used?

Bitcoin miners run double SHA-256 — SHA-256 applied twice — billions of times a second, searching for a hash below a target value. The same function also derives Bitcoin addresses from public keys, so every transaction on the network depends on it.

On the web, SHA-256 signs TLS certificates, so your browser can check that the certificate it received is the one the authority issued. Git used SHA-1 for years to identify commits and is moving to SHA-256; the idea is the same either way — a commit's hash is its identity, and changing history changes every hash after it.

Software downloads publish SHA-256 checksums next to the file: download, hash, compare. If your hash matches the published one, the file arrived intact and untampered. Package managers, app stores, and Linux distributions all rely on this check, and it is the same check a file-integrity monitor runs on a server overnight.

Practical tips

• Compare hashes, don't eyeball files. After downloading software, run the checksum and compare all 64 characters — matching the first eight is not enough.
• Hash the file, not the filename. Renaming a file changes nothing about its hash; editing one byte changes everything.
• Don't use SHA-256 alone for passwords. Add a unique salt per user and a slow function like Argon2 or bcrypt; raw SHA-256 is too fast to slow down guessing.
• Keep the input bytes exact. A trailing newline or a different text encoding produces a different hash, so hash the same bytes you mean to verify.
• Treat a hash as a fingerprint, not a secret. A hash proves what the data was, but anyone can compute the hash of known data — it is not encryption.
• When two hashes differ, the data differs. There is no "close enough": even a one-bit difference means the files are not the same.

Frequently asked questions

What is SHA-256?

SHA-256 is a cryptographic hash function that converts any input into a fixed 256-bit value, written as 64 hexadecimal characters. It is part of the SHA-2 family, designed by the NSA and published by NIST in 2001. The same input always gives the same hash, a tiny change in the input gives a completely different hash, and the process cannot be reversed. It is used to verify file integrity, sign certificates, and secure blockchains.

Can SHA-256 be reversed or decrypted?

No. SHA-256 is a one-way function: the hash reveals nothing about the input, and there is no key or decryption step. The only way to find an input that matches a given hash is to guess inputs one by one, and with 2^256 possible hashes that search is far beyond any computer. That is why a SHA-256 hash is safe to publish — it proves what data you had without revealing the data itself.

How long is a SHA-256 hash?

A SHA-256 hash is always 256 bits long, which is 32 bytes or 64 hexadecimal characters — two hex characters per byte. The length never changes: an empty string, a single word, and a multi-gigabyte video all produce exactly 64 hex characters. If a value labelled SHA-256 is shorter or longer than that, it is not a SHA-256 hash, or it has been truncated or mistyped.

What is the difference between SHA-256 and MD5?

MD5 produces a 128-bit hash (32 hex characters) and has known collision attacks since 2004, so attackers can craft two different files with the same MD5 hash. SHA-256 produces a 256-bit hash (64 hex characters) and has no practical attack. MD5 is still fine for non-security checksums, but for signatures, certificates, or anything where forgery matters, use SHA-256.

Is SHA-256 still secure in 2026?

Yes. No attack better than brute force is known against SHA-256, and brute force means searching a space of about 1.16 × 10^77 hashes. Quantum computers change the picture somewhat — Grover's algorithm could in theory halve the effective security to 128 bits — but 128 bits is still far beyond reach, and SHA-256 remains the standard choice for certificates, blockchains, and integrity checks.

Can two different inputs have the same SHA-256 hash?

In theory, yes: there are infinitely many possible inputs but only 2^256 possible hashes, so collisions must exist. In practice, finding one is a different matter — the birthday paradox puts the effort at about 2^128 hashes, or 3.4 × 10^38 tries. No collision has ever been found, and none is expected with any hardware we can build.

Related tools