PureTools

SHA-256 Hashing: How It Works and When to Use It

PureTools Team· 8 min read
SHA-256 Hashing: How It Works and When to Use It

SHA-256: The Hash Behind Everything

SHA-256 is the workhorse of modern cryptography. It takes any input — a single character or an entire database dump — and produces a fixed 256-bit (32-byte) hash. Bitcoin uses it. Git uses it. TLS certificates use it. If you work with software, you're using SHA-256 whether you know it or not.

What Makes a Good Hash Function

A cryptographic hash function has four properties:

  • Deterministic: Same input always produces the same output.
  • Fixed size: Output is always 256 bits (64 hex characters), regardless of input size.
  • Irreversible: You can't recover the original input from the hash.
  • Collision-resistant: It's computationally infeasible to find two different inputs with the same hash.

SHA-256 in Action

# Terminal
echo -n "hello" | sha256sum
# 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

echo -n "hello!" | sha256sum
# ce06092fb948d9ffac7d1a376e404b26b7575bcc11ee05a4615fef4fec3a308b

Notice: changing one character completely changes the hash. This is called the avalanche effect — a tiny input change produces a dramatically different output.

Common Uses

Use CaseHow SHA-256 Helps
File integrityDownload a file, hash it, compare with the published hash. If they match, the file wasn't tampered with.
Git commitsEvery commit is identified by a SHA hash of its contents, parent, author, and timestamp.
Digital signaturesYou hash the document first, then sign the hash (much faster than signing the entire document).
Bitcoin miningMiners compute SHA-256(SHA-256(block_header)) looking for a hash below a target threshold.
HMACCombine SHA-256 with a secret key to create a message authentication code.
Certificate pinningPin the SHA-256 hash of a server's public key to prevent MITM attacks.

SHA-256 vs Other Hashes

AlgorithmOutput SizeStatusUse Case
MD5128 bitsBroken (collisions found)Checksums only, never for security
SHA-1160 bitsDeprecated (collisions demonstrated)Legacy systems only
SHA-256256 bitsSecureGeneral purpose cryptographic hashing
SHA-512512 bitsSecureWhen you need a longer hash
SHA-3VariableSecureAlternative to SHA-2 family

Implementation

// JavaScript (browser or Node.js)
async function sha256(message) {
  const encoder = new TextEncoder();
  const data = encoder.encode(message);
  const buffer = await crypto.subtle.digest('SHA-256', data);
  return Array.from(new Uint8Array(buffer))
    .map(b => b.toString(16).padStart(2, '0'))
    .join('');
}

await sha256('hello');
// "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
# Python
import hashlib

hash = hashlib.sha256(b'hello').hexdigest()
print(hash)
# 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
// Go
package main

import (
    "crypto/sha256"
    "fmt"
)

func main() {
    h := sha256.Sum256([]byte("hello"))
    fmt.Printf("%x\n", h)
}

SHA-256 Is NOT For Passwords

This is the most common mistake. SHA-256 is fast — which is exactly what you don't want for password hashing. An attacker can compute billions of SHA-256 hashes per second on a GPU.

For passwords, use:

  • bcrypt — adjustable cost factor, widely supported
  • scrypt — memory-hard, resists GPU attacks
  • Argon2 — winner of the Password Hashing Competition, state of the art

SHA-256 is for integrity and identification. Bcrypt/Argon2 are for passwords. Don't mix them up.

Verifying File Integrity

# Generate hash of a file
sha256sum ubuntu-24.04-desktop-amd64.iso
# a1b2c3d4... ubuntu-24.04-desktop-amd64.iso

# Verify against a checksum file
sha256sum -c SHA256SUMS
# ubuntu-24.04-desktop-amd64.iso: OK

Always verify checksums when downloading ISOs, binaries, or anything security-critical. It takes 2 seconds and prevents supply chain attacks.

Hash your data now: SHA-256 Generator — paste any text and get the SHA-256 hash instantly. Everything runs in your browser.

← Back to blog