cybersecurity cryptography

SHA-256

sha-256 sha-2 hashing integrity cryptography
Plain English

SHA-256 is a recipe for making a fingerprint of any file or message. Feed in anything, a single word or a 6 GB installer, and you get back a 64-character code. The same input always gives the same code, and changing even one letter gives a completely different one. That is how you prove a download was not damaged or tampered with.

Technical Definition

SHA-256 is part of the SHA-2 family published by NIST in FIPS 180-4. It processes input in 512-bit blocks through 64 rounds of a compression function and outputs a 256-bit digest, usually shown as 64 hexadecimal characters.

Properties:

  • Deterministic: same input, same digest, everywhere
  • Avalanche effect: a one-bit change flips about half the output bits
  • Preimage resistance: you cannot work backward from a digest to the input
  • Collision resistance: no practical way to find two inputs with the same digest

Where it is used:

  • File integrity: SHA256SUMS files for ISOs and software releases
  • TLS certificates (signature algorithm sha256WithRSAEncryption or ECDSA with SHA-256)
  • Git’s newer object format, container image digests (sha256:...), and package repositories
  • Bitcoin proof of work

Hashing is not encryption and is not reversible. For passwords, use slow purpose-built functions (bcrypt, scrypt, Argon2), not raw SHA-256.

Status: no practical attacks against SHA-256. MD5 and SHA-1 are broken for collision resistance and should not be trusted for security.

Source: NIST FIPS 180-4 Secure Hash Standard

Computing SHA-256 digests 

# A file
$ sha256sum ubuntu-26.04-desktop-amd64.iso
<64 hex characters>  ubuntu-26.04-desktop-amd64.iso

# A string (note -n: no trailing newline)
$ echo -n "bytesnation" | sha256sum

# Check many files against a list
$ sha256sum -c SHA256SUMS --ignore-missing
ubuntu-26.04-desktop-amd64.iso: OK

# macOS and Windows
$ shasum -a 256 file.iso
PS> Get-FileHash file.iso -Algorithm SHA256
In the Wild

You will run SHA-256 every time you download an ISO, verify a release binary, or pin a container image by digest. Pinning by digest (image@sha256:...) instead of a tag means you get exactly the bytes you tested, even if someone re-pushes the tag. Pair the hash with a GPG signature on the checksum file, because a hash alone only proves the file matches whatever list you compared it to.

← Back to Dictionary