SHA-256: The Default Choice and How It Is Used
SHA-256 is the 256 bit member of the SHA-2 family from FIPS 180-4 and the sensible default for general hashing. There is no practical collision or preimage attack against it. It is still wrong for passwords, and it is vulnerable to length extension.
At a glance
- Digest size
- 256 bits
- Hex characters
- 64
- Block size
- 512 bits (64 bytes), 32 bit words, 64 rounds
- Standard
- FIPS 180-4, part of the SHA-2 family published in 2001
- Broken for collisions
- No. The best published attacks reach a reduced round variant, not the full 64 rounds
- Safe for password storage
- No. Use a memory-hard password hash such as Argon2id, scrypt or bcrypt
- Available in the generator
- Yes, plus HMAC-SHA-256 when a secret is supplied
In detail
SHA-256 is a Merkle-Damgard hash built on a Davies-Meyer compression function over 32 bit words, running 64 rounds per 512 bit block. Its 256 bit output means a birthday collision search needs about 2^128 work, which is far beyond anything buildable. Twenty five years of analysis has produced collisions only for reduced round versions, currently in the region of 31 of 64 rounds, with no path visible to the full function.
It is the correct default. Certificate signatures, Git's newer object format, container image digests, software bill of materials entries, blockchain proof of work, subresource integrity attributes and JSON Web Token signatures all use it, and interoperability is universal. If you are choosing a hash and have no specific reason to choose otherwise, choose this one and move on.
Its one structural weakness matters in a narrow case. Because the digest is the internal state at the end, an attacker who knows SHA-256(secret + message) and the length of the secret can extend the message and compute a valid digest for the longer input without ever learning the secret. Any homemade API signature of the form hash(key + body) is forgeable this way. HMAC-SHA-256 exists precisely to close this, and it is what every well designed webhook signature uses.
Hardware acceleration changes the performance argument. Most current x86 and ARM chips implement SHA-256 rounds as native instructions, so it often outruns MD5 in real measurements despite doing much more work. There is no longer a speed reason to keep a legacy hash in a hot path, which removes the last common excuse for MD5 in new code.
Speed is also why it is wrong for passwords. A single SHA-256 is a few hundred nanoseconds, so a leaked table of unsalted SHA-256 password hashes falls to a GPU dictionary run quickly. Iterating it yourself is not the answer either; use Argon2id, scrypt or bcrypt, which are designed to be expensive in memory as well as time. ToolBox does not offer a password hashing tool and this generator is not one.
Examples
input: "" -> e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
input: "abc" -> ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ade3b0c442... is the digest of zero bytes and is the single most useful hash value to recognise on sight, because it means an empty read.
input: "" -> 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=
input: "abc" -> ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0=
An integrity attribute is written as: integrity="sha256-<base64>"Switch the generator output to Base64 to produce the value in this shape directly.
Things that catch people out
- Do not build API request signing as sha256(secret + payload). That construction is forgeable by length extension. Use HMAC-SHA-256, which the generator computes when you fill in the secret field.
- A 64 character hex string could be SHA-256, SHA3-256 or Keccak-256. They are different algorithms with the same output width, so length alone cannot tell you which one produced a value, and the Verify tab will list all three.
- Hashing a password with SHA-256 plus a salt is still not password storage. The problem is throughput, not tables.
- Comparing digests with a plain string equality that returns early can leak timing information when the value being compared is a secret tag. For authentication tags, use a constant time comparison in your own code; a hex string in a browser field is not where that risk lives, but the same digest in your server code is.
Try it: Hash Generator
Paste text or drop a file and get every digest at once, in hex or Base64, with a verify tab for comparing an expected value against what you actually have.
Hash Generator
LOCAL · Browser-OnlyGenerate MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, Keccak-256, CRC32, and HMAC hashes from text or files
MD5 is cryptographically broken and should not be used for security purposes. Use SHA-256 or SHA-512 instead.
Related Hash algorithms
All hash algorithms →SHA-512: 512 Bit Digests and 64 Bit Word Arithmetic
SHA-512 outputs 128 hex characters using 64 bit words and 1024 bit blocks. Why it can beat SHA-256 on 64 bit hardware, and where the extra width is pointless.
SHA3-256: The Sponge Construction and How It Differs From SHA-256
SHA3-256 gives the same 64 hex characters as SHA-256 from a completely different construction. No length extension, different failure modes, FIPS 202.
HMAC-SHA-256: Signing and Verifying Payloads Correctly
HMAC-SHA-256 gives a 64 character authentication tag. Why it replaces hash(secret + body), how webhook signatures use it, and how verification goes wrong.
SHA-1: Practical Collisions and What Replaced It
SHA-1 gives a 160 bit digest, 40 hex characters. Collisions became practical in 2017 and chosen prefix collisions in 2020. What still uses it and why.
SHA-384: Truncated SHA-512 and Why the Truncation Helps
SHA-384 is SHA-512 with a different starting state, cut to 384 bits. That truncation removes the length extension weakness. 96 hex characters explained.
SHA3-512: Maximum Sponge Capacity and When to Choose It
SHA3-512 outputs 128 hex characters and holds back 1024 bits of capacity, halving throughput versus SHA3-256. What that buys and when it is worth it.
Tools for this
- Hash Generator Free online hash generator - generate MD5, SHA-1, SHA-256 hashes from any input text
- Base64 Encoder/Decoder Base64 encode and decode online - convert text to Base64 or decode Base64 strings instantly, free