SHA-256: The Hash Function behind Bitcoin

SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function from the SHA-2 family that turns an input of any practical length into a fixed 256-bit (32-byte) output, called a hash or digest. SHA-256 is not encryption, because it uses no key and has no decryption step. Bitcoin’s proof of work (the process in which miners repeatedly hash a block header) and its transaction records are built on SHA-256.

What Does the SHA-256 Algorithm Do to an Input?

A hash function such as SHA-256 works like a fingerprint machine. The same input always gives the same fixed-size fingerprint, and a different input gives, in practice, a different fingerprint that looks unrelated to the first. NIST, the U.S. National Institute of Standards and Technology, describes a hash function as one that maps a message of any length to a fixed-length digest.

As of October 2026, SHA-256 is one of six approved functions in the SHA-2 family, NIST has specified it in its Secure Hash Standard since 2002, and the current version of that standard is FIPS 180-4. The 256 in the name is the length of the output in bits, not a key size and not a limit on the input. The algorithm accepts inputs of up to just under 2 to the power of 64 bits, far beyond any real file.

The output of SHA-256 is 256 bits, or 32 bytes, and it is usually written as 64 hexadecimal characters. Hexadecimal is a base-16 notation that uses the digits 0-9 and the letters a-f, and each character stands for 4 bits, so 256 bits take 64 characters.

People also write the name as SHA256 or SHA 256, and all three spellings refer to the same function. This entry covers SHA-256 only; hash functions in general belong to the cryptographic hash entry.

What Does a SHA-256 Hash Look Like?

A SHA-256 hash looks like a random string of 64 hexadecimal characters. The table shows the SHA-256 hash of the three-character text “abc” (the digest matches the test value NIST publishes for that input) and of “abd” (an input that differs from “abc” by one character).

Input	SHA-256 hash (64 hexadecimal characters)
abc	ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
abd	a52d159f262b2c6ddb724a61840befc36eb30c88877a4030b65cbe86298449c9

In SHA-256, changing the last letter of “abc” to “abd” alters 58 of the 64 hexadecimal characters, and nothing in the second hash hints that the two inputs were almost identical.

Which Properties Make SHA-256 Useful?

Deterministic. SHA-256 always produces the same hash for the same input, on any computer. Anyone can recompute a hash and compare the result with a published one.

Fixed length. SHA-256 always returns 256 bits, whether the input is a single letter or an entire book. A 64-character hash therefore has the same size no matter what data sits behind it.

One-way. SHA-256 is designed to be one-way, which means that finding an input that maps to a pre-specified output is computationally infeasible. As of October 2026, no practical attack on the full SHA-256 function is known, so in practice an input for a given hash can be found only by trying inputs one after another and comparing each result. That is why a weak input stays at risk even when it is hashed.

Avalanche effect. SHA-256 shows an avalanche effect: a tiny change in the input produces a hash that looks unrelated to the original. Changing “abc” to “abd” changes 122 of the 256 output bits.

Collision resistance. SHA-256 is designed to be collision resistant. A collision is a pair of different inputs that produce the same hash, and a hash function is collision resistant when finding such a pair is computationally infeasible. Collisions must exist mathematically, because the possible inputs outnumber the possible outputs. SHA-256 has 2 to the power of 256 possible outputs, a number with 78 digits, and, as of October 2026, no collision for the full function is known.

Where Does Bitcoin Use SHA-256?

SHA-256 is the Bitcoin hash function in several places, and Bitcoin usually applies it twice. This is called double SHA-256, also written SHA-256d: the output of the first pass is hashed a second time, and the final output is still 256 bits, not 512.

Proof of work is the mechanism in which Bitcoin miners repeatedly hash the 80-byte block header, the summary of a block that has six fields: version, previous block hash, Merkle root, time, nBits, and nonce. A header is valid if its double SHA-256 hash, read as a 256-bit number, is equal to or below the target.

In Bitcoin’s proof of work, the target is the threshold that a block hash must not exceed, and nBits is the target in compact form. Because the hash must be at or below the target, a lower target is harder to meet. The nonce is a 4-byte field that miners change on each attempt before they hash the header again.

A Merkle tree summarizes all transactions in a block. Bitcoin hashes transaction IDs in pairs, hashes the results in pairs again, and repeats until one hash, the Merkle root, remains. Changing any transaction changes the Merkle root, and because the root sits in the header, it changes the block’s hash.

A transaction ID is the double SHA-256 hash of the serialized transaction, which means its version, inputs, outputs, and locktime. A SegWit (Segregated Witness) transaction also carries witness data, the part that holds items such as the signature and public key, and its transaction ID leaves that part out.

A single-key address is one built from one public key. For legacy and SegWit single-key addresses, Bitcoin hashes the public key with SHA-256 and then with RIPEMD-160, a second hash function with a 160-bit (20-byte) output. Other address types are built differently and are not covered here.

Four of the places where Bitcoin uses SHA-256 are summarized in this table.

Bitcoin structure	What is hashed	How SHA-256 is used
Block header	The 80-byte header	Double SHA-256; the result must be at or below the target
Merkle tree	Pairs of transaction IDs	Double SHA-256 at each level, up to one Merkle root stored in the header
Transaction ID	The serialized transaction, without witness data	Double SHA-256
Address (legacy and SegWit single-key)	The public key	SHA-256, then RIPEMD-160

The Bitcoin network’s hashrate, the number of hashes it computes per second, was estimated at more than 1,000 exahashes per second (EH/s) as of October 2026. One exahash is a quintillion, or 10 to the power of 18, hashes. Providers report slightly different values, and the figure changes from day to day.

Why Are Bitcoin Mining ASICs Built for SHA-256?

SHA-256 is the Bitcoin mining algorithm: the calculation that miners repeat is the hashing of block headers. An application-specific integrated circuit (ASIC) is a chip made for one specific use instead of general-purpose computing. A Bitcoin mining ASIC is therefore laid out to compute SHA-256 hashes, and such chips generally cannot be used for anything but Bitcoin mining.

A Bitcoin mining ASIC is tied to the SHA-256 algorithm, not to one coin, because the spec sheet of a single machine can list several coins that use the same algorithm. Other proof-of-work coins use other hash functions, such as Scrypt, and they need different hardware.

The speed of a Bitcoin mining ASIC is its hashrate, measured in terahashes per second (TH/s), where one terahash is a trillion hashes. As an example, Bitmain’s Antminer S21 XP is a Bitcoin mining ASIC that lists SHA-256 as its algorithm and, as of October 2026, a typical hashrate of 270 TH/s.

What Does SHA-256 Not Do?

SHA-256 is not encryption. Encryption changes plaintext into ciphertext with a cryptographic algorithm and a key, and decryption reverses that change. SHA-256 takes no key and has no decryption step, so a phrase such as “SHA-256 encryption” is a misnomer, and a SHA-256 hash cannot be “decrypted.”

A SHA-256 hash does not protect a weak input. A hash cannot be calculated backward, but anyone can hash guesses and compare them with the target hash. NIST’s password guidance says that an attacker holding hashed passwords can guess offline without limits on attempts, and that short or predictable secrets, such as common words or previously breached passwords, fall to brute-force and dictionary attacks. A four-digit PIN has only 10,000 possible values, so its SHA-256 hash gives it no practical protection.

SHA-256 has no proof of permanent security. As of October 2026, no practical attack on the full SHA-256 function is known, but that describes current knowledge, not a proof. Published collision attacks reach only reduced versions of SHA-256: a 2024 research paper reported a semi-free-start collision, in which the attacker may choose the starting state, for a 39-step version, while the full function has 64 steps.