Learning Point Hub

Data & cryptography · 2 min read

What is SHA-256?

By Oliver James Whitmore · Updated 20 October 2026

In one sentence

SHA-256 is a specific, standardised hash function from the SHA-2 family that turns any input into a 256-bit fingerprint, and it is the hash function at the heart of Bitcoin.

How SHA-256 processes a message: padding, 512-bit blocks, 64 rounds per block, a 256-bit result.Messageany lengthPad and split512-bit blocksCompress64 roundsDigest256 bitsrepeat for every block8 working values, mixed by additions, bit rotations and logic functionsBitcoin hashes block headers twice in a row (double SHA-256)
How SHA-256 processes a message: padding, 512-bit blocks, 64 rounds per block, a 256-bit result.

How it works

SHA stands for Secure Hash Algorithm. The SHA-2 family, which includes SHA-256, was designed by the US National Security Agency and published by NIST in 2002 in the standard FIPS 180-2. The current edition of the standard is FIPS 180-4, from 2015.

The algorithm works in a few steps. First it pads the message so its length is a multiple of 512 bits, adding the original length at the end. Then it cuts the result into 512-bit blocks and feeds them through a compression function one at a time. Inside, eight 32-bit working values are mixed through 64 rounds of simple operations — additions, bit rotations and logical functions — together with fixed constants. Each block changes the eight values, and after the last block they are joined to form the 256-bit result, normally written as 64 hexadecimal characters.

No single step is mysterious; the strength comes from repeating cheap operations many times so that every output bit depends on every input bit. No practical method for finding two inputs with the same SHA-256 output is publicly known.

Bitcoin applies SHA-256 twice in a row, a construction often called double SHA-256, to block headers and transaction identifiers. Other networks chose differently: Ethereum, for example, uses Keccak-256.

A simple example

NIST publishes test values so that anyone can check an implementation. The SHA-256 hash of the three letters "abc" is:

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

Any correct SHA-256 program, on any computer, produces exactly this string for that input — and something completely different for "abd" or "Abc".

Common misconception

Misconception: Bitcoin is "encrypted with SHA-256", which is what keeps it secret.

In fact: SHA-256 does not encrypt anything, and the Bitcoin record is public. SHA-256 links blocks, drives mining and is one step in building many address types. Control over funds comes from digital signatures made with private keys, which use a different kind of cryptography.

Where you meet it

  • Bitcoin block identifiers, transaction identifiers and proof of work.
  • Certificates that secure HTTPS connections in your browser.
  • Checksums published next to software downloads.

Sources

This card explains a technical concept for general education. It is not a recommendation to acquire, sell or hold any crypto-asset, and it is not financial advice.