What Is SHA-256? How It Works, MD5 vs SHA-256 and Checksums

SHA-256 is a cryptographic hash function that turns any input, from a single letter to a multi-gigabyte file, into a fixed 256-bit value, usually written as 64 hexadecimal characters. It belongs to the SHA-2 family, which NIST published in FIPS 180-2 in 2002. The same input always gives the same hash, and the hash cannot be turned back into the input.

Try it free: Hash Text Online - SHA256 Generator, MD5 Checker & SHA512 Hash Generator Free to use, no account needed.

So what is SHA-256 used for? Mostly for proving that data hasn't changed: download checksums, TLS certificates, Git, Bitcoin and signed API requests rely on it. This guide explains how SHA-256 works, how MD5 vs SHA-256 compare, what a checksum is and how to verify a SHA-256 checksum on Windows, macOS and Linux. Every hash below was computed with code and checked twice. To try the examples yourself, paste them into the free hash generator.

What is SHA-256?

SHA stands for Secure Hash Algorithm. SHA-2 was designed by the NSA and standardized by NIST, first in FIPS 180-2 (2002) and today in FIPS 180-4. The family has several members named after their output size: SHA-224, SHA-256, SHA-384 and SHA-512, plus SHA-512/224 and SHA-512/256. SHA-256 is the most widely used of them.

A hash works like a fingerprint for data. Here is a SHA-256 hash example for the word "hello" and for empty input:

SHA-256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-256("")      = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Both results have the same length, because the output is always 256 bits. That is 32 bytes, and since one hex digit holds 4 bits, it takes 256 ÷ 4 = 64 hex characters.

How SHA-256 works, in brief

1. Padding. The message gets a 1 bit, then zeros, then its original length as a 64-bit number, so that the total is a multiple of 512 bits.
2. Blocks. The padded message is split into 512-bit blocks.
3. Compression. Each block goes through 64 rounds of simple operations on 32-bit words: bit rotations, XOR, AND and addition modulo 2³². These rounds mix the block into an internal state of eight 32-bit words (8 × 32 = 256 bits).
4. Output. After the last block, the state is the hash.

Each block changes the state the next block starts from, so a change anywhere in the input affects the result.

Key properties of SHA-256

• Deterministic. The same bytes always give the same hash, on any computer.
• Fixed size. A 5-byte word and a 5 GB file both produce 64 hex characters.
• Avalanche effect. A tiny change in the input changes the output completely.
• Preimage resistance. Given a hash, there is no known way to find a matching input other than guessing.
• Collision resistance. Nobody has ever found two different inputs with the same SHA-256 hash.

The avalanche effect is easy to see. "hello" and "Hello" differ in one letter, and the letters h (01101000) and H (01001000) differ in just one bit:

SHA-256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-256("Hello") = 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969

The two hashes differ in 125 of their 256 bits, close to the half you would expect from random output, and in 61 of the 64 hex characters.

One limit: preimage resistance protects unpredictable data, not short guessable strings. The hash of "hello" is in every online lookup table, because anyone can hash common words and store the results.

What is a checksum?

A checksum is a short value computed from data so that you can later tell whether the data has changed. Simple checksums such as CRC32, used in ZIP files and network packets, catch accidental errors like a bad download or a faulty disk, but they are easy to fake on purpose.

SHA-256 used as a checksum also protects against deliberate tampering, because nobody can build a modified file that matches the original value. One condition: the expected hash must come from a source you trust, such as the project's official HTTPS site or a signed checksum file. An attacker who controls the download page can change the file and the published hash together.

Where SHA-256 is used

• Software downloads. Linux distributions and many apps publish SHA-256 checksums for their installers, often in a SHA256SUMS file.
• TLS certificates. The certificate that secures an HTTPS site is signed over a SHA-256 hash in most cases, shown as "sha256WithRSAEncryption" or "ecdsa-with-SHA256". Major browsers stopped trusting SHA-1-signed certificates in 2017.
• Bitcoin. Miners hash block headers with SHA-256 applied twice (double SHA-256) and keep changing a number called the nonce until the result falls below a target. That search is the proof of work.
• Git. Git has traditionally named commits and files by their SHA-1 hash. Since version 2.29 (2020), git init --object-format=sha256 creates a repository that uses SHA-256 instead.
• HMAC-SHA256 and JWT. HMAC mixes a secret key into the hash, so only someone with the key can produce a valid value. Webhooks and API requests are often signed this way, and the JWT algorithm HS256 is HMAC with SHA-256; the HMAC Generator computes one. Don't use a plain SHA-256(key + message) instead: it is open to length-extension attacks, which HMAC prevents.

MD5 vs SHA-256 (and SHA-1, SHA-512)

The same input through all four:

MD5("hello")     = 5d41402abc4b2a76b9719d911017c592
SHA-1("hello")   = aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
SHA-256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-512("hello") = 9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043

What is MD5? MD5 is an older 128-bit hash from 1992. In 2004, researchers led by Xiaoyun Wang showed how to build two different inputs with the same MD5 hash, and later work made such collisions fast to compute. MD5 must not be used where someone might deliberately craft a matching file.

SHA-1 lasted longer. In February 2017, CWI Amsterdam and Google announced SHAttered: two different PDF files with the same SHA-1 hash. NIST recommends replacing SHA-1 completely by 31 December 2030.

SHA-256 has no known practical attack. A brute-force collision search would take about 2¹²⁸ attempts, which is far beyond any existing computer.

So in the MD5 vs SHA-256 choice, use SHA-256 for anything related to security. MD5 is still fine for jobs where nobody is trying to fool you, such as spotting accidental corruption or finding duplicate files on your own disk.

SHA-256 and SHA-512 are both secure; SHA-256 is the more widely supported default. SHA-3 (FIPS 202, 2015) is a separate design, standardized as an alternative rather than because SHA-2 was broken.

Hashing is not encryption

Encryption, such as AES, is reversible: with the right key you get the original data back. A hash has no key and no way back; it keeps 256 bits however large the input is, so the original data isn't in the output. Websites that claim to "decrypt SHA-256" only look up hashes of common words and passwords that they computed in advance.

Why plain SHA-256 is wrong for passwords

SHA-256 is designed to be fast, and that is exactly the problem for passwords. If a database of SHA-256 password hashes leaks, attackers can test billions of guesses per second on graphics cards. Without a salt, two users with the same password also get the same hash.

Passwords need a slow, salted password hashing function: Argon2id, scrypt or bcrypt (or PBKDF2 with a high iteration count). They make every guess expensive. For the details of salts and what happens when a hashed password leaks, read what happens when a password gets hashed.

How to verify a SHA-256 checksum

1. Copy the expected SHA-256 value from the official download page or checksum file.
2. Compute the hash of the file you downloaded.
3. Compare all 64 characters, not just the first few. Upper and lower case don't matter in hex.

If the values differ, delete the file and download it again from the official source.

Windows

In Command Prompt:

certutil -hashfile ubuntu.iso SHA256

Always add SHA256: without it, certutil uses SHA-1. In PowerShell, Get-FileHash uses SHA-256 by default and can compare for you:

Get-FileHash .\ubuntu.iso
(Get-FileHash .\ubuntu.iso).Hash -eq "paste-the-expected-hash-here"

The second line prints True or False; -eq ignores case, so the uppercase output matches a lowercase checksum.

macOS

shasum -a 256 ubuntu.iso
shasum -a 256 -c ubuntu.iso.sha256

The first line prints the hash. The second checks it against a checksum file, which contains the hash, two spaces and the file name.

Linux

sha256sum ubuntu.iso
sha256sum -c SHA256SUMS --ignore-missing

With -c, sha256sum reads the checksum file and prints ubuntu.iso: OK or FAILED. --ignore-missing skips entries for files you didn't download.

A common trap when hashing text on the command line: echo "hello" | sha256sum gives 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03, not the 2cf24d… value above, because echo adds a newline. Use printf 'hello' | sha256sum to hash exactly five bytes.

In your browser

The MD5 & SHA-256 hash generator computes MD5, SHA1, SHA224, SHA256, SHA384, SHA512, Keccak-256 and RIPEMD160 at once, in Text or File mode.

• Text: it hashes exactly what you type as UTF-8, and a counter shows the byte count, so a stray space or line break is easy to spot.
• File: the file is read and hashed locally with the crypto-js library, without being uploaded.
• Verify: paste the published value into "Expected hash" and the matching algorithm is marked Match. Hex comparison ignores case, spaces and a 0x prefix.
• Output: hexadecimal (lower or upper case), Base64, Base64url or binary.

Two limits: the whole file is loaded into memory first, so for multi-gigabyte ISOs the command-line tools above are the better choice. And the row labelled SHA3 is Keccak-512 with the original padding, which differs from NIST SHA3-512.

FAQ

Can SHA-256 be decrypted or reversed?

No. SHA-256 is a one-way function with no key. "SHA-256 decrypters" only find inputs that are already in their lookup tables, which works for common words and weak passwords but not for random data.

Is SHA-256 still secure?

Yes. There is no known practical collision or preimage attack on SHA-256, and NIST still approves it. Even a large quantum computer running Grover's algorithm would, as far as is known, only reduce the preimage effort from about 2²⁵⁶ to about 2¹²⁸ operations.

Why is a SHA-256 hash 64 characters long?

The hash is 256 bits. Written in hexadecimal, each character represents 4 bits, so 256 ÷ 4 = 64 characters. The same value is 32 bytes, or 44 characters in Base64.

What is the difference between SHA-2 and SHA-256?

SHA-2 is the family of hash functions defined in FIPS 180-4. SHA-256 is one member of it, alongside SHA-224, SHA-384 and SHA-512. When software says "SHA-2" without a size, it usually means SHA-256.

Can two files have the same SHA-256 hash?

In theory yes, because there are infinitely many possible files and only 2²⁵⁶ possible hashes. In practice, no one has ever found two different inputs with the same SHA-256 hash, so matching hashes are treated as proof that the files are identical.

Try it free: Hash Text Online - SHA256 Generator, MD5 Checker & SHA512 Hash Generator Free to use, no account needed.