SHA-256 (SHA-2 with 256-bit output)

SHA-256 is a hash function from the SHA-2 family, specified by NIST in FIPS 180-4, that outputs a 256-bit digest and offers about 128-bit collision resistance. Other SHA-2 members include SHA-384 and SHA-512. It replaced SHA-1 across the WebPKI in the mid-2010s.

Why it matters

SHA-256 is everywhere in TLS. Most certificates are signed with sha256WithRSAEncryption or ecdsa-with-SHA256 (P-384 certificates often use SHA-384). TLS 1.2 commonly uses it in its PRF, TLS 1.3 suites such as TLS_AES_128_GCM_SHA256 use it in HKDF, Certificate Transparency logs build their Merkle trees with it, and certificate fingerprints and DANE TLSA records usually rely on it. Known quantum algorithms give only a limited speedup against hash functions, so SHA-256 is not threatened in the way RSA and ECC are.

Example

Compute a certificate fingerprint and the SHA-256 hash of its public key (the value used in a TLSA 3 1 1 record):

openssl x509 -in example.com.crt -noout -fingerprint -sha256
openssl x509 -in example.com.crt -noout -pubkey | openssl pkey -pubin -outform DER | openssl dgst -sha256

The certificate fingerprint changes on every renewal; the public-key hash stays the same as long as you reuse the key.

Common misconceptions

• "A SHA-256 certificate is a special product." "SHA-256" only describes the signature hash, and every publicly trusted certificate issued today uses SHA-256 or stronger.
• "SHA-256 means 256-bit encryption." It is a hash function, not a cipher; it encrypts nothing.
• "Quantum computers will break SHA-256 like RSA." Shor's algorithm does not apply to hash functions, and the speedup from Grover-style search leaves SHA-256 with a comfortable margin.