What is SHA-256 (Secure Hash Algorithm 256-bit)?
SHA-256 belongs to the SHA-2 family of cryptographic hash functions designed by the United States National Security Agency (NSA) and published by the National Institute of Standards and Technology (NIST) under FIPS PUB 180-4.
A cryptographic hash takes an input of arbitrary length and produces a deterministic, fixed-size 256-bit (32-byte) fingerprint, typically rendered as a 64-character hexadecimal string.
Essential Cryptographic Properties of SHA-256
- Pre-image Resistance (One-Way Function): Given a hash digest
H, it is computationally infeasible to find an input messagemsuch thatSHA256(m) = H. - Second Pre-image Resistance: Given an input message
m1, it is computationally infeasible to locate another distinct messagem2that produces the identical hash. - Collision Resistance: Finding any two distinct messages that hash to the exact same value requires an unfeasible
2^128operations. - The Avalanche Effect: Changing a single bit in the input message completely and unpredictably randomizes more than 50% of the output bits.
Comparison of Popular Hashing Algorithms
| Algorithm | Digest Size | Security Status | Recommended Modern Usage |
|---|---|---|---|
| MD5 | 128 bits (32 hex) | Broken (Practical collisions exist) | Non-cryptographic checksums only. |
| SHA-1 | 160 bits (40 hex) | Deprecated (SHAttered attack 2017) | Phased out of SSL/TLS certificates and Git. |
| SHA-256 | 256 bits (64 hex) | Secure (Standard) | SSL/TLS, Bitcoin, Digital Signatures, API tokens. |
| SHA-512 | 512 bits (128 hex) | Highly Secure | High-security government systems, 64-bit architectures. |
Computing SHA-256 in Code
Modern Browser JavaScript (Web Crypto API)
async function computeSha256(message) {
const msgBuffer = new TextEncoder().encode(message);
const hashBuffer = await crypto.subtle.digest('SHA-256', msgBuffer);
const hashArray = Array.from(new Uint8Array(hashBuffer));
return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
}
Python 3 (hashlib)
import hashlib
text = "secure_developer_password"
hash_digest = hashlib.sha256(text.encode('utf-8')).hexdigest()
print("SHA-256:", hash_digest)
Frequently Asked Questions
Should I use raw SHA-256 to hash user passwords?
No. While SHA-256 is mathematically secure, it is designed for extreme computational speed. Attackers with modern GPUs can compute billions of SHA-256 hashes per second to brute-force passwords. For password storage, use adaptive, salted key-derivation algorithms like Argon2id, bcrypt, or PBKDF2.
What is the length of a SHA-256 hash?
A SHA-256 hash is always exactly 256 bits in binary, which corresponds to 32 raw bytes, and translates to exactly 64 hexadecimal characters regardless of whether the input is one letter or an entire encyclopedia.