Part 1 — The idea
A fingerprint for data
A hash function takes anything — a password, a photo, the entire text of a novel — and returns a short, fixed-length number. SHA-256 always returns 256 bits, written as 64 hexadecimal characters. One byte in or one gigabyte in, the output is the same size.
Think of it as a fingerprint. You cannot rebuild the person from it, but it identifies them, and nobody you meet shares one: a small tag standing in for a large thing.
For that tag to be worth anything, three promises have to hold. Given a fingerprint, you should not be able to build a file that produces it. Given a file, you should not be able to build a second file matching it. And you should not be able to find any colliding pair at all, even when you pick both.
Those are preimage resistance, second-preimage resistance, and collision resistance. The third breaks first, because the attacker has the most freedom — not chasing a target you chose, but hunting anywhere for a matching pair.
Part 2 — Lineage
How we got here
The family tree starts with Ron Rivest's MD4 in 1990 and MD5 in 1991. MD5 spread everywhere, then fell: in 2004 a team led by Xiaoyun Wang demonstrated practical collisions, and within a few years attackers were forging real certificates with them.
In parallel, the NSA designed a hash in the same style and NIST published it in 1993 as FIPS 180. It was withdrawn almost immediately over an unpublished flaw, and is now called SHA-0. The repaired SHA-1 arrived in 1995 as FIPS 180-1 and became the default hash of the internet for two decades.
SHA-2 — SHA-256, SHA-512 and their truncated siblings — was published in 2001 as FIPS 180-2, well before anyone urgently needed it. That timing mattered. When SHA-1 began to fail, the replacement was already standardized and sitting in every crypto library.
SHA-3 is not the sequel you might expect. NIST ran an open competition, chose the Keccak design in 2012, and standardized it in 2015 as FIPS 202. It uses a different internal structure — a sponge, not the chaining construction SHA-2 relies on — so a future break of SHA-2 would not take SHA-3 with it. It is a complement, not a replacement, and SHA-256 remains the default.
Part 3 — Preparing the message
Bits first, then padding
SHA-256 does not know what text is. It works on bits, so the first move is converting whatever you typed into binary: each character becomes its ASCII or UTF-8 byte, each byte becomes eight bits. Your message … becomes … bits, and nothing else about it survives.
The algorithm works in fixed 512-bit chunks, so that bit string has to reach a multiple of 512. Padding does it in three parts: append a single 1 bit, then enough 0 bits to make room, then the original message length as a 64-bit number in the final slot.
L + 1 + K ≡ 448 (mod 512)
On your input the recipe reads: … message bits, the 1, … zeros, and then the length — … — written as a 64-bit number ending in …. That comes to … bits: …, exactly.
The 1 bit and the length field are not bookkeeping; they are load-bearing security. Without the separator, ab and ab followed by a zero byte would pad to an identical bit string and hash to an identical digest — a collision you could stumble into by accident. The length field closes off other near-identical messages the same way.
Part 4 — Blocks and schedule
Sixteen words become sixty-four
The padded message is cut into 512-bit blocks, and each block into sixteen 32-bit words, since 512 divided by 32 is 16. A short message is one block; a large file is many, processed one after another.
See your message split into blocks
Each block then gets a message schedule: sixty-four words, W0 through W63, one for each of the sixty-four rounds ahead. The first sixteen are the block's own words. The other forty-eight are manufactured from words already in the list — on your block, the first manufactured one comes out W16 = ….
Wt = σ1(Wt−2) + σ0(Wt−15) + Wt−7 + Wt−16
The σ functions fold and together with . Their purpose is diffusion: after expansion, a single bit of your block has smeared its influence across many of the sixty-four schedule words instead of affecting one round and going quiet. That is the difference between a hash and a checksum, where each input bit touches the output exactly once.
Part 5 — Starting values
Where the magic numbers come from
SHA-256 needs two sets of numbers it did not get from you: eight 32-bit starting values for the working state, and sixty-four round constants. They are not arbitrary, and they are not chosen.
The eight initial values are the first 32 bits of the fractional parts of the square roots of the first eight primes — frac(√2) × 232 gives 6a09e667, the value loaded into register a. The sixty-four constants come the same way from the cube roots of the first sixty-four primes: frac(∛2) × 232 is 428a2f98, which is K0. Those fractional parts are irrational, so the bits look random and never repeat.
H0 = frac(√prime) × 232 Kt = frac(∛prime) × 232
Part 6 — The engine
Sixty-four rounds of compression
Eight 32-bit registers named a through h hold the working state. They start at the initial hash values, and then sixty-four rounds beat on them. Each round consumes one schedule word and one constant, and produces two temporary words — in round 1 on your block they come out T1 = … and T2 = ….
T1 = Σ1(e) + Ch(e, f, g) + h + Kt + Wt
T2 = Σ0(a) + Maj(a, b, c)
Three ideas do the work. chooses: at each bit position, the bit of e is a switch, taking the bit from f when it is 1 and from g when it is 0. votes: each output bit is whichever value appears in at least two of the three inputs. Both are nonlinear — you cannot unwind them with algebra — and that is what makes the function hard to run backwards.
The smear. Each rotates its input by three different amounts and XORs the results, so a bit sitting in position 3 lands in three other positions at once.
Then the round shuffles. Every register slides down one place — a into b, b into c, and so on — with a becoming T1 + T2 and e becoming its old d plus T1. Sixty-four times.
When the rounds finish, the eight registers are added back into the values the block started with. That addition seals the step: even if you could invert all sixty-four rounds, you would still be stuck adding two unknowns to reach one known.
Part 7 — Avalanche
Change one bit, change everything
Here it is on your own numbers. Your message hashes to …. Change just the last character — making it … — and the digest becomes …. That single character flipped … of the 256 output bits, and there is no visible relationship between the two.
This is the avalanche effect, and it is no accident. It is everything in Part 6 accumulating: the schedule expansion carrying your bit into many rounds, the Σ rotations relocating it, the nonlinear Ch and Maj mixing it with unrelated bits, sixty-four times over.
It also explains why "close" is meaningless for hashes. Two digests match or they do not; a one-bit difference and a one-gigabyte difference produce equally unrelated outputs.
Part 8 — In the wild
Where SHA-256 lives today
Every TLS certificate your browser accepts is signed over a SHA-256 digest of its contents. Collision resistance is what stops anyone from producing a second certificate that the same signature would also cover.
Bitcoin's proof-of-work applies SHA-256 twice to a block header and asks miners to find a header whose double digest falls below a target. The avalanche effect is the whole mechanism: nobody can steer the output, so the only strategy is to change the header and try again, billions of times a second.
Git identifies every object by its hash. It was built on SHA-1, and after SHAttered the project hardened that SHA-1 with collision detection and began an ongoing migration to SHA-256 object identifiers. Distributors publish SHA-256 checksums so you can confirm a download arrived intact, and HMAC-SHA256 wraps the hash around a secret key to authenticate API requests and webhooks.
Part 9 — Further reading
Go deeper
FIPS 180-4 is the NIST standard covering the whole SHA-1 and SHA-2 family, with every constant and function written out. It is more readable than you would expect, and everything above is a plain-language reading of it.
For the SHA-1 collision, the researchers built shattered.io around the two colliding PDFs, so you can download both and hash them yourself.
This site's SHA-256 walkthrough is adapted from and inspired by the SHA-256 Animation, an MIT-licensed project by Greg Walker that animates the algorithm step by step in a terminal. The stage structure of the lab above follows his work, and it is worth running yourself.