SHA-256 & SHA-512 Calculator

What you are looking at

A SHA-256 checksum is 64 hexadecimal characters, the written form of a 256-bit number. Every byte of the file feeds into it, so a single changed byte gives an unrelated result. The SHA-256 of an empty file is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, a value worth recognising because it shows up whenever a download silently produced a zero-byte file.

SHA-256 is today's default file checksum. When a download page shows only one hash, it is usually this one, and when it shows several, this is the one to prefer. If you are comparing it with an older MD5 value, the MD5 vs SHA-256 comparison explains how the two differ. If the published value is 128 characters long, it is SHA-512: pick SHA-512 in step 2 and read the SHA-512 section below.

The SHA-2 family

SHA-256 belongs to SHA-2, a family of hash functions designed by the NSA and published by NIST in 2001, then standardised in FIPS 180-2. The current edition of the standard is FIPS 180-4. SHA-2 was introduced while SHA-1 was still considered secure, so it was ready when SHA-1 started to fail.

SHA-256 works on 32-bit words: it splits the padded input into 512-bit blocks and runs 64 rounds per block over a 256-bit state. Its sibling SHA-512, published in the same 2001 release, uses the same structure with 64-bit words, 1024-bit blocks and 80 rounds over a state twice as large. SHA-3, standardised in 2015, is an unrelated design kept as an alternative, not a replacement; SHA-256 remains approved and widely deployed.

Why SHA-256 is trusted

More than two decades of public cryptanalysis have produced attacks only on reduced versions of SHA-256 that skip many of its 64 rounds. Against the full function, no collision has ever been shown, and the generic cost of finding one by brute force is around 2¹²⁸ operations, far beyond any computer that exists.

Two caveats are worth knowing, because they concern how SHA-256 is used rather than the hash itself:

• ›It is not a password hash. SHA-256 is designed to be fast, which helps attackers test billions of guesses. Passwords belong in a deliberately slow function such as Argon2, bcrypt, scrypt or PBKDF2.
• ›It is not a MAC on its own. Because of a property called length extension, computing SHA-256 over a secret followed by a message lets an attacker append data and still produce a valid value. Use HMAC-SHA-256 when you need to authenticate a message with a key.

Neither caveat affects file checksums: comparing a file's SHA-256 with a value you trust is exactly the job the function was built for.

Where you meet SHA-256

• ›Software downloads. Linux distributions such as Ubuntu and Debian publish a SHA256SUMS file for their images, usually with a GPG signature beside it. Many open-source projects post a .sha256 file next to each release.
• ›Container images. Docker and other OCI tools name image content by digest, written as sha256: followed by 64 hex characters, and you can pull an exact image with name@sha256:….
• ›Bitcoin. Block headers are hashed twice with SHA-256 for proof of work, and transaction IDs use the same double SHA-256.
• ›TLS certificates. Current certificates are signed using SHA-256 (for example sha256WithRSAEncryption), and browsers show certificate fingerprints as SHA-256.
• ›Package installers. pip's hash-checking mode accepts pins such as --hash=sha256:… in a requirements file, and refuses packages that do not match.
• ›Web pages. Subresource Integrity lets a page require that a script matches a SHA-256, SHA-384 or SHA-512 value before the browser runs it.

Checking a download step by step

1. Get the expected value from the publisher's own site, ideally over HTTPS and, if a signature is offered, after verifying it (for Ubuntu: gpg --verify SHA256SUMS.gpg SHA256SUMS).
2. Find the line for your exact file name: checksum lists often cover a dozen variants, and the desktop and server images of the same release have different hashes.
3. Select the downloaded file above, keep SHA-256 selected and calculate.
4. Paste the expected value into the verify box. You can paste the whole line from the checksum list; the hash at the start is used and case is ignored.
5. Green means the bytes on your disk are the bytes the publisher hashed. Red means stop: download again, and if it still fails, do not run the file.

The download verification guide shows where well-known projects publish their checksums.

SHA-256 from a terminal

Windows PowerShell

Get-FileHash .\ubuntu.iso

SHA-256 is Get-FileHash's default algorithm, so no switch is needed. The hash is printed in upper case, which still matches a lower-case published value. In a classic Command Prompt, use certutil -hashfile ubuntu.iso SHA256.

macOS

shasum -a 256 ubuntu.iso

Linux

sha256sum ubuntu.iso
sha256sum -c SHA256SUMS --ignore-missing

The --ignore-missing option checks only the files you actually downloaded, instead of reporting every other image in the list as missing.

Any system with OpenSSL

openssl dgst -sha256 ubuntu.iso

All of these read the same bytes and produce the same 64 characters as the calculator above. If two tools disagree, they were not given the same file.

SHA-512 and SHA-384

SHA-512 output is 512 bits, written as 128 hexadecimal characters, long enough that it often wraps across two lines in a terminal or a PDF. When comparing by eye, check the first and last eight characters and let a tool do the rest; the verify box under the result does a full comparison. The digest of an empty file is a useful reference:

cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce
47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

(shown here on two lines; the real value is one unbroken string of 128 characters).

Several other algorithms are SHA-512 underneath, which helps when a checksum does not have the length you expect:

• ›SHA-384: SHA-512 with different initial values, cut to 384 bits (96 hex characters). The calculator above supports it directly.
• ›SHA-512/256 and SHA-512/224: added in FIPS 180-4 in 2012, again with their own initial values, cut to 256 or 224 bits. A SHA-512/256 value is 64 characters long like SHA-256 but is a different number, so it must be checked with a SHA-512/256 tool.

Because the truncated variants hide part of the internal state, they are not exposed to the length-extension property that affects full SHA-256 and SHA-512 when they are misused as message authentication codes.

Is SHA-512 faster than SHA-256?

Often, but not always. SHA-512 processes 128 bytes per block with 80 rounds of 64-bit arithmetic, while SHA-256 processes 64 bytes per block with 64 rounds of 32-bit arithmetic. On a 64-bit processor running plain software, SHA-512 therefore does more useful work per round and is frequently the faster of the two on large files.

Hardware changes the picture. Many recent x86 and ARM processors include dedicated instructions for SHA-256, and software that uses them can make SHA-256 considerably faster than a software SHA-512. Whether that applies depends on both the chip and the program.

The reliable answer is to measure on the machine that matters: with OpenSSL installed, openssl speed sha256 sha512 prints the throughput of both for several block sizes. For file checksums the difference is rarely decisive, because reading the file from disk usually takes longer than hashing it.

When to choose SHA-512

• ›The publisher gives a SHA-512 value, as Debian does with a SHA512SUMS file for its installation images alongside SHA256SUMS.
• ›You are building an archive or evidence record meant to last decades and want the extra margin: SHA-512 offers about 256 bits of collision resistance against about 128 for SHA-256.
• ›You process large volumes on 64-bit machines without SHA-256 hardware support, where SHA-512 may be quicker.
• ›A format requires it: npm lock files record package integrity as SHA-512, and the Ed25519 signature scheme uses SHA-512 internally.

For an ordinary download check where SHA-256 is offered, SHA-256 is enough; neither is “more secure” in a way that matters when comparing a file against a trusted checksum. The algorithm guide sets out the trade-offs across all the options.

One name causes confusion: password entries in /etc/shadow that begin with $6$ use sha512-crypt. That scheme is not a plain SHA-512 of the password; it adds a random salt and repeats the hashing thousands of times (5,000 rounds by default) to make every guess expensive, and several distributions have since moved their default to yescrypt. A single SHA-512 of a password, salted or not, is weak protection for the reason given above.

SHA-512 in hex, Base64 and on the command line

SHA-512 values appear in two encodings. Checksum files and most tools print 128 hex characters. npm's integrity fields and Subresource Integrity attributes use Base64 with a prefix, such as sha512-z4PhNX7v…, 88 characters ending in two equals signs. Both describe the same 64 bytes. To produce the Base64 form of a file's digest, or to turn Base64 back into hex:

openssl dgst -sha512 -binary package.tgz | openssl base64 -A
echo 'z4PhNX7v…' | base64 -d | xxd -p | tr -d '\n'

The terminal commands follow the SHA-256 ones above with a different algorithm name:

Get-FileHash .\debian.iso -Algorithm SHA512     # PowerShell
certutil -hashfile debian.iso SHA512             # Command Prompt
shasum -a 512 debian.iso                         # macOS
sha512sum -c SHA512SUMS --ignore-missing         # Linux
sha384sum debian.iso                             # Linux, SHA-384

Since every line of a SHA-512 checksum list is long, a common mistake is copying a value from the wrong line of SHA512SUMS. Search the list for your exact file name before comparing.

SHA-256 and SHA-512 questions

Related pages