What is SHA-512/256?
SHA-512/256 is a SHA-2 hash function that produces a 256-bit digest (64 hex characters) using SHA-512's internal machinery: 64-bit words, 128-byte blocks and 80 rounds. It begins from its own initial hash value and outputs only the first half of the final state. Same output size as SHA-256, different engine, and no length-extension weakness.
Both SHA-512/224 and SHA-512/256 were standardized in FIPS 180-4. Of the two, SHA-512/256 is the one with real-world uptake.
Why not just use SHA-256?
SHA-256 is fine for most work, and it's what this site's hash generator offers. SHA-512/256 earns its place in two situations.
You're hashing secrets together with data. SHA-256's digest is its entire internal state. If a system computes SHA-256(secret || message) and publishes the result, an attacker can resume hashing from that state and produce a valid digest for secret || message || anything, without knowing the secret. This is the length-extension attack. SHA-512/256 throws away 256 of its 512 state bits, so there's nothing to resume from. HMAC remains the right tool for keyed hashing, but SHA-512/256 removes a class of mistakes.
You're running on 64-bit hardware and hashing a lot of data. SHA-512's compression function processes 128 bytes per call using 64-bit operations, and on many 64-bit CPUs that works out faster per byte than SHA-256. That benefit depends heavily on the platform; CPUs with dedicated SHA-256 instructions can flip it. This browser tool uses BigInt arithmetic for clarity, so don't judge speed from it.
Truncation alone isn't the algorithm
People sometimes try to build SHA-512/256 by hashing with SHA-512 and keeping 64 characters. That doesn't work, because the standard changes the starting state as well:
SHA-512/256("abc") 53048e2681941ef99b2e29b76b4c7dabe4c2d0c634fc6d46e0e2f13107e7af23
SHA-512("abc"), first 64 ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a
SHA-256("abc") ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
The first line is the NIST example value and exactly what this generator outputs. The separate IV is deliberate: it makes SHA-512/256 a distinct function, so a SHA-512 digest can never be passed off as a SHA-512/256 digest of the same message.
| SHA-256 | SHA-512/256 | SHA-512 | |
|---|---|---|---|
| Output | 256 bits | 256 bits | 512 bits |
| Word size | 32-bit | 64-bit | 64-bit |
| Rounds | 64 | 80 | 80 |
| Length extension possible | Yes | No | Yes |
| Collision resistance | 128 bits | 128 bits | 256 bits |
| Native in Web Crypto | Yes | No | Yes |
Where it's specified
RFC 7616, the current HTTP Digest Access Authentication standard, defines SHA-512-256 as one of its algorithms alongside the mandatory SHA-256 (note the hyphen in place of the slash). Library names vary in the same way: OpenSSL takes -sha512-256, Node.js 'sha512-256', Python's hashlib 'sha512_256' when its OpenSSL build provides it, and PHP 'sha512/256'.
Generating and checking a digest
- Paste your text into the input. It's hashed as UTF-8 bytes, exactly as typed, including any trailing spaces or line breaks.
- Click Generate to get 64 lowercase hex characters. An empty input gives no output.
- To confirm elsewhere, pipe the same bytes to OpenSSL:
printf '%s' 'hello world' | openssl dgst -sha512-256
The result, 0ac561fac838104e3f2e4ad107b4bee3e938bf15f2b15f009ccccd61a913f017, is the same value this tool shows for hello world.
Related tools
The SHA-512/224 generator is the shorter sibling with the same design. The SHA3-256 generator is the other 256-bit hash immune to length extension, built on a completely different construction. When you need a keyed tag rather than a bare digest, use the HMAC generator.
Last updated