SHA-256
SHA-256 belongs to the SHA-2 family designed by the NSA and published in 2001. It is fast, audited, and still the default choice for integrity checks two decades later.
In this lesson
- State the output size of SHA-256 in bits, bytes and hex characters
- Compute a SHA-256 digest from the terminal
- Explain why SHA-1 and MD5 are no longer acceptable
Prerequisites
- required What is hashing?
Fixed size, familiar shape
SHA-256 always outputs 256 bits — 32 bytes, written as 64 hexadecimal characters. Because 256 bits is long enough to make collisions impractical yet cheap to store and compare, it shows up everywhere: git, TLS certificates, Bitcoin block headers, Docker images and software signing.
| Algorithm | Digest size | Status |
|---|---|---|
| MD5 | 128 bit (32 hex) | Broken — never for security |
| SHA-1 | 160 bit (40 hex) | Deprecated since 2017 |
| SHA-224 | 224 bit | Occasionally used in protocols |
| SHA-256 | 256 bit | Recommended default |
| SHA-512 | 512 bit | Faster on 64-bit CPUs, larger output |
import hashlib\n\nmessage = b"Hello Blockchain"\ndigest = hashlib.sha256(message).hexdigest()\n\nprint(len(digest)) # 64 characters\nprint(digest)printf "Hello Blockchain" | openssl dgst -sha256\n# (stdin)= 7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069Example · Verifying what you install
Package managers publish SHA-256 sums for every release artifact. Before running an installer you can verify it in one line — and a mismatch means either corruption or tampering.
GitHub shows the same digest next to every release file for exactly this reason.
SHA-1 is finished
In 2017 researchers constructed two distinct PDFs with an identical SHA-1 digest (SHAttered). Browsers and certificate authorities dropped SHA-1 immediately. MD5 fell years earlier. If a system still signs with MD5 or SHA-1, treat it as a finding.
Compare digests
Hash the same string with SHA-256 in the lab and confirm you can reproduce the 64-character output above.
A hash is a fingerprint, not a locked box.
Output size
Practice · server-gradedHex characters
Practice · server-gradedWrite the pseudocode
Practice · server-gradedPractice exercise
Practice: SHA-256
Practice
- SHA-256 quiz Start