SHA-256 is a cryptographic hash function from the SHA-2 family, designed by the NSA and standardized by NIST. It takes any input and produces a fixed 256-bit (64-character hexadecimal) digest. SHA-256 is one-way: it cannot be reversed to recover the input. It is not encryption; it is used to verify integrity, in digital signatures, certificates, and blockchains.
SHA-256 is a cryptographic hash function in the SHA-2 family, designed by the National Security Agency (NSA) and published by NIST. It converts any input, of any size, into a fixed 256-bit output called a hash or digest. SHA-256 is one-way and deterministic: the same input always gives the same hash, but the hash cannot be reversed. It is used to verify data integrity, not to encrypt data.
Key Takeaways
- SHA-256 is a cryptographic hash function in the SHA-2 family; it outputs a fixed 256-bit (32-byte) digest for any input.
- It is a hash, not encryption: SHA-256 is one-way and cannot be reversed or ‘decrypted’ to recover the original input.
- It is deterministic (same input, same hash) and exhibits the avalanche effect (a tiny input change flips about half the output bits).
- SHA-256 is used for data integrity, digital signatures, certificates, blockchain, and file verification. For passwords, use a slow, salted function (bcrypt, scrypt, Argon2, or PBKDF2), not plain SHA-256.
- SHA-256 is secure in 2026 (unlike the broken SHA-1) and is quantum-resistant: Grover’s algorithm only weakens it to about 128-bit preimage security, and there is no Shor threat to hash functions.
What Is SHA-256?
SHA stands for Secure Hash Algorithm, a family of cryptographic hash functions designed by the NSA and published by NIST. SHA-256 is a member of the SHA-2 family, introduced in 2001 as a stronger successor to SHA-1. The ‘256’ refers to the size of its output: SHA-256 always produces a 256-bit digest (a 64-character hexadecimal string), no matter how large or small the input is.
A crucial point, especially since SHA-256 is sometimes grouped with encryption algorithms: SHA-256 is a hash function, not an encryption algorithm. Encryption is reversible; with the right key you can decrypt ciphertext back to plaintext. Hashing is one-way by design: you can compute the hash of an input, but you cannot reverse the hash to recover the input. There is no key and no decryption. This is exactly what makes hashing useful for verifying integrity and authenticity rather than for keeping data secret.
Properties of SHA-256
- Deterministic: The same input always produces the same 256-bit hash, which is what lets two parties compare hashes to confirm data matches.
- One-way (preimage resistance): Given a hash, it is computationally infeasible to find the original input. There is no decryption step.
- Avalanche effect: Changing even a single bit of the input produces a completely different-looking hash, so similar inputs do not produce similar hashes.
- Collision resistance: It is computationally infeasible to find two different inputs that produce the same hash. SHA-256 has no known practical collision attack, unlike the older SHA-1.
- Fast: SHA-256 is fast to compute on modern hardware, which is ideal for integrity checks (though, as noted below, being fast is why it should not be used alone for passwords).
How Does SHA-256 Work?
SHA-256 processes input through a series of well-defined steps. At a high level:
- Padding: The message is padded so its length is a multiple of 512 bits. Padding appends a single ‘1’ bit, then ‘0’ bits, and finally the original message length encoded as a 64-bit value.
- Initialization: Eight 32-bit hash values (defined in the SHA-256 specification) are set as the starting state.
- Processing in blocks: The padded message is split into 512-bit blocks. Each block is processed in turn.
- Compression: For each block, a compression function runs 64 rounds of bitwise operations, modular additions, and logical functions, mixing the block into the current hash state.
- Iteration and output: The output of each block becomes the input state for the next. After the last block, the final 256-bit state is the SHA-256 hash.
For example, hashing the text ‘Hello, SHA-256!’ produces a fixed 256-bit value, written as a 64-character hexadecimal string. Change one character and the entire hash changes unrecognizably, the avalanche effect in action.
Where Is SHA-256 Used?
- Digital signatures: SHA-256 is used with public-key cryptography to sign data. The signature is computed over the hash of the message, so verifying the signature also confirms the data has not changed.
- Digital certificates: Certificate Authorities use SHA-256 to hash and sign digital certificates. Modern TLS certificates use SHA-256, having moved off the deprecated SHA-1.
- Blockchain: SHA-256 is central to Bitcoin and many other blockchains, where it hashes blocks to link them immutably and underpins proof-of-work mining.
- File integrity: Publishers provide a SHA-256 checksum for downloads so users can verify a file was not corrupted or tampered with, by hashing it and comparing.
- Secure communication: Protocols like TLS use SHA-256 within their integrity and signature mechanisms to protect data in transit.
Important: SHA-256 Alone Is Not for Password Storage
A common misconception is that you can securely store passwords by saving their SHA-256 hash. You should not. SHA-256 is designed to be fast, which is exactly the wrong property for passwords: an attacker who steals the hashes can try billions of guesses per second. Secure password storage uses a slow, salted, purpose-built password-hashing function such as bcrypt, scrypt, Argon2, or PBKDF2. These add a unique random salt (so identical passwords hash differently) and are deliberately slow or memory-hard to resist brute-force and rainbow-table attacks. SHA-256 is excellent for integrity and signatures, but password hashing is a different job with different tools.
Is SHA-256 Secure?
Yes. As of 2026, SHA-256 is considered secure and is one of the most widely trusted hash functions in the world. There is no known practical attack that finds collisions or reverses it. This is in sharp contrast to SHA-1, which is broken (practical collisions were demonstrated in 2017) and has been deprecated. SHA-256, along with the rest of the SHA-2 family and the newer SHA-3, remains a NIST-approved standard. The main theoretical caveat, common to all hash functions, is that collisions must exist mathematically (there are infinitely many inputs and finitely many outputs); the point is that finding one is computationally infeasible.
Is SHA-256 Quantum-Safe? The 2026 Outlook
SHA-256 is in a strong position for the quantum era. As a hash function, it is not affected by Shor’s algorithm, which breaks public-key algorithms like RSA and ECC but has nothing to attack in a keyless hash. The relevant quantum algorithm is Grover’s, which speeds up brute-force search, but only quadratically. That reduces SHA-256’s preimage resistance from 256 bits to about 128 bits of effective security, which is still considered strong and safe for the foreseeable future. For collision resistance, quantum attacks offer only limited advantage over the best classical ‘birthday’ attacks, so SHA-256’s roughly 128-bit classical collision resistance is not meaningfully worsened. In short, SHA-256 does not need to be replaced for quantum reasons, and SHA-384 and SHA-512 provide even larger margins. The urgent post-quantum migration (where NIST finalized ML-KEM, ML-DSA, and SLH-DSA in 2024 and plans to retire RSA and ECC by 2030 to 2035) is about public-key cryptography. Notably, the post-quantum signature standard SLH-DSA is itself built on hash functions, a reminder of how trusted strong hashing remains.
How Encryption Consulting Helps
Using the right hash function in the right place, SHA-256 for integrity and signatures, a proper password-hashing function for passwords, and modern algorithms in certificates and protocols, is part of a sound cryptographic posture. Encryption Consulting’s Encryption Advisory Services assess how hashing and encryption are used across your environment, flag weak or misused algorithms (such as SHA-1 or plain-SHA-256 password storage), and align everything to standards like NIST and FIPS 140-3, including planning for the post-quantum transition of your public-key cryptography. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.
Frequently Asked Questions
What is SHA-256?
SHA-256 is a cryptographic hash function in the SHA-2 family, designed by the NSA and published by NIST. It takes an input of any size and produces a fixed 256-bit output, written as a 64-character hexadecimal string. SHA-256 is one-way and deterministic: the same input always yields the same hash, but the hash cannot be reversed to recover the input. It is widely used for data integrity, digital signatures, certificates, and blockchain.
Is SHA-256 encryption?
No. SHA-256 is a hash function, not an encryption algorithm. Encryption is reversible, you can decrypt ciphertext back to plaintext with the right key. Hashing is one-way: you can compute the hash of an input, but there is no key and no way to reverse the hash to recover the original data. SHA-256 is used to verify integrity and authenticity, for example in digital signatures and file checksums, rather than to keep data secret. Encryption and hashing solve different problems.
How does SHA-256 work?
SHA-256 pads the input to a multiple of 512 bits, sets eight 32-bit initial hash values, and splits the message into 512-bit blocks. Each block runs through a compression function of 64 rounds of bitwise operations, modular additions, and logical functions, mixing the block into the current hash state. The output of each block feeds into the next, and after the final block the resulting 256-bit state is the hash. A single-bit change in the input changes the entire output, the avalanche effect.
Is SHA-256 secure?
Yes. As of 2026, SHA-256 is considered secure and is among the most trusted hash functions in use. There is no known practical attack that reverses it or finds collisions. This contrasts with SHA-1, which is broken (practical collisions were demonstrated in 2017) and deprecated. SHA-256 is part of the NIST-approved SHA-2 family. Collisions must exist in theory, because inputs are unlimited and outputs are finite, but finding one is computationally infeasible.
Can you use SHA-256 to store passwords?
Not on its own. SHA-256 is designed to be fast, which lets an attacker who steals the hashes try billions of guesses per second. Secure password storage instead uses a slow, salted, purpose-built password-hashing function such as bcrypt, scrypt, Argon2, or PBKDF2. These add a unique salt so identical passwords hash differently, and are deliberately slow or memory-hard to resist brute-force and rainbow-table attacks. SHA-256 is ideal for integrity and signatures, but password hashing needs these specialized functions.
Is SHA-256 quantum-safe?
Yes, largely. As a hash function, SHA-256 is not affected by Shor’s algorithm, which breaks public-key algorithms like RSA and ECC. The relevant quantum attack, Grover’s algorithm, provides only a quadratic speedup, reducing SHA-256’s preimage resistance to about 128 bits of effective security, which is still strong. Its collision resistance is not meaningfully worsened. So SHA-256 does not need replacing for quantum reasons, and SHA-384 or SHA-512 offer even greater margins. The post-quantum transition mainly concerns public-key cryptography.
Get Your Cryptography Right
Choosing and using hash functions and encryption correctly across your systems has a real impact on security. Explore Encryption Consulting’s Encryption Advisory Services to assess your cryptographic posture and prepare for the post-quantum era.