SHA-256

SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function designed by the NSA and standardized by NIST in 2001 as part of the SHA-2 family. It produces a 256-bit (64 hexadecimal character) digest from any input. No practical attacks on SHA-256 have been demonstrated — it is the current standard for general-purpose cryptographic hashing.

Properties

• Deterministic: the same input always produces the same hash
• Fast: designed for speed (unlike password hashing functions)
• Pre-image resistant: cannot reverse a hash to find the input
• Collision resistant: finding two inputs with the same hash is computationally infeasible
• Avalanche effect: changing one bit of input changes approximately half the output bits

Example

SHA-256("") = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA-256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-256("hello!") = ce06092fb948d9ffac7d1a376e404b26b7575bcc11ee05a4615fef4fec3a308b

Computing SHA-256

// Web Crypto API
async function sha256(message) {
  const data = new TextEncoder().encode(message);
  const hash = await crypto.subtle.digest("SHA-256", data);
  return [...new Uint8Array(hash)].map(b => b.toString(16).padStart(2, "0")).join("");
}

Use Cases

• File integrity: verify a downloaded file matches its published SHA-256 checksum
• Digital signatures: TLS certificates, code signing
• HMAC: keyed message authentication (HMAC-SHA256)
• Blockchains: Bitcoin uses double SHA-256 (SHA-256 applied twice)
• Git: object hashing (migrating from SHA-1 to SHA-256)

What SHA-256 Is Not

SHA-256 is too fast for password storage — a GPU can compute billions per second. Use bcrypt or Argon2id for passwords. SHA-256 is also not encryption — it is one-way and has no key.

Calculate SHA-256 hashes in your browser with the Hash Generator Tool.