# What Is SHA-256 (SHA-2 with 256-bit output)?

> SHA-256 is the 256-bit member of the SHA-2 hash family (NIST FIPS 180-4) and the standard hash for signing and fingerprinting TLS certificates today.

Source: https://ssl.sh/glossary/sha-256/
Last updated: 2026-11-10

SHA-256 is a [hash function](https://ssl.sh/glossary/hash-function/) from the SHA-2 family, specified by NIST in FIPS 180-4, that outputs a 256-bit digest and offers about 128-bit collision resistance. Other SHA-2 members include SHA-384 and SHA-512. It replaced [SHA-1](https://ssl.sh/glossary/sha-1/) across the WebPKI in the mid-2010s.

## Why it matters
SHA-256 is everywhere in TLS. Most certificates are signed with sha256WithRSAEncryption or ecdsa-with-SHA256 (P-384 certificates often use SHA-384). TLS 1.2 commonly uses it in its PRF, TLS 1.3 suites such as TLS_AES_128_GCM_SHA256 use it in HKDF, [Certificate Transparency](https://ssl.sh/glossary/certificate-transparency/) logs build their Merkle trees with it, and certificate fingerprints and DANE [TLSA](https://ssl.sh/glossary/tlsa/) records usually rely on it. Known quantum algorithms give only a limited speedup against hash functions, so SHA-256 is not threatened in the way RSA and ECC are.

## Example
Compute a certificate fingerprint and the SHA-256 hash of its public key (the value used in a TLSA 3 1 1 record):

```bash
openssl x509 -in example.com.crt -noout -fingerprint -sha256
openssl x509 -in example.com.crt -noout -pubkey | openssl pkey -pubin -outform DER | openssl dgst -sha256
```

The certificate fingerprint changes on every renewal; the public-key hash stays the same as long as you reuse the key.

## Common misconceptions
- **"A SHA-256 certificate is a special product."** "SHA-256" only describes the signature hash, and every publicly trusted certificate issued today uses SHA-256 or stronger.
- **"SHA-256 means 256-bit encryption."** It is a hash function, not a cipher; it encrypts nothing.
- **"Quantum computers will break SHA-256 like RSA."** Shor's algorithm does not apply to hash functions, and the speedup from Grover-style search leaves SHA-256 with a comfortable margin.

## Related terms

- [哈希函数](https://ssl.sh/zh/glossary/hash-function/): 哈希函数（密码学哈希函数）把任意长度的输入映射为固定长度的摘要，且在计算上无法逆推输入，也无法找到摘要相同的两个输入。
- [SHA-1](https://ssl.sh/zh/glossary/sha-1/): SHA-1 是 1995 年发布的 160 位哈希函数，已出现实际可行的碰撞攻击，公开信任的 TLS 证书早已不再允许使用它签名。
- [数字签名](https://ssl.sh/zh/glossary/digital-signature/): 数字签名是用私钥对消息计算出的一个值，任何持有对应公钥的人都能验证它，从而确认消息来源和内容未被篡改。
- [证书指纹](https://ssl.sh/zh/glossary/certificate-fingerprint/): 证书指纹是对证书 DER 编码计算出的哈希值（通常用 SHA-256），用来唯一标识一张证书，它本身并不存储在证书里。
- [证书透明度](https://ssl.sh/zh/glossary/certificate-transparency/): 证书透明度（CT）是一套公开、只可追加的日志系统，记录所有公开信任的 TLS 证书，让任何人都能审计 CA 签发了什么。
- [TLSA 记录](https://ssl.sh/zh/glossary/tlsa/): TLSA 记录是一种 DNS 记录，声明某个端口和协议上的 TLS 服务必须出示哪张证书或哪个公钥，供 DANE 校验使用。