SHA-256
A 256-bit fingerprint for any input — one-way, collision-resistant, and the verification engine of the digital world.
Why This Matters
A cryptographic hash maps a variable-length message to a fixed-length digest. Different inputs must sometimes share a digest; collision resistance means that finding such a pair should be computationally infeasible. SHA-256 is widely used for checksums, signatures and Bitcoin proof-of-work. It has no decryption operation, but an attacker can still guess a low-entropy input and compare its digest. A bare hash also does not authenticate its sender.
NIST published SHA-1 in 1995 and FIPS 180-2 in August 2002, adding SHA-256, SHA-384 and SHA-512. SHA-224 was added in a 2004 change notice. The widely publicized MD5 collisions of 2004 and SHA-1 attacks from 2005 therefore came after this SHA-2 standardization. NIST later selected Keccak through a public competition; SHA-3 was standardized in 2015 as a structurally different family, not because full SHA-256 had been practically broken.
The input is padded so its length is congruent to 448 mod 512, then a 64-bit length is appended. The padded message is split into 512-bit blocks. Each block is processed by the compression function, which mixes the block into a 256-bit internal state through 64 rounds of bitwise operations: rotations, XORs, AND/OR/NOT, modular addition, and round constants derived from the cube roots of the first 64 primes. After the last block the internal state is the hash output.
Two security goals are preimage resistance (finding an input for a specified digest) and collision resistance (finding any two distinct inputs with the same digest). Generic classical work factors for an ideal 256-bit hash are about 2256 and 2128 respectively. These are search-model estimates, not a guarantee that a guessable password takes that much work to recover.
No practical collision attack is known against full SHA-256. Its Merkle–Damgård structure permits length extension: from H(secret ‖ data) and its length, an attacker can derive a digest for an extended message without learning the secret. Therefore that construction is not a safe message authentication code. Use an appropriate keyed construction such as HMAC-SHA-256; changing to an unkeyed SHA-3 hash does not itself provide authentication. Idealized Grover search reduces the generic preimage query exponent, but does not give an inexpensive real-world attack or settle every post-quantum application.
| Where | How SHA-256 is Used |
|---|---|
| TLS / HTTPS | SHA-256 is common; certificate signatures can use other approved hashes and signature algorithms |
| Git | Git supports SHA-1 repositories and a SHA-256 object format; repository format determines the identifier |
| Bitcoin | Proof-of-work searches for a double-SHA-256 digest, interpreted as an integer, below the current target |
| Password storage | Used in PBKDF2-HMAC-SHA256 and scrypt. Argon2 instead uses BLAKE2b internally; raw SHA-256 is unsuitable for password storage |
| Software integrity | sha256sum, package manager checksums, signed releases on every modern OS |
| Digital signatures | RSA-PSS and ECDSA can use SHA-256. Ed25519 uses SHA-512 as specified in RFC 8032 |
| Era | Modern · 2002 |
| Status | Secure; SHA-3 (Keccak) standardised 2015 as a structural alternative, not a replacement |
| Origin | NSA (designed); published by NIST as FIPS 180-2 in 2002 |
| Year | 2002 |
| Type | Cryptographic hash function (Merkle-Damgård construction over the SHA-2 compression function) — not a cipher |
| Modern Role | Certificate signatures, software checksums, selected password KDFs, Bitcoin proof-of-work and selected signature schemes |