SHA-512/256 Hash Generator

SHA-512/256 hash generator

SHA-512/256 gives you a 256-bit digest — the same size as SHA-256 — computed with the SHA-512 engine and its own initial values. Standardised in FIPS 180-4 in 2012, it combines SHA-512’s speed on 64-bit processors with a shorter output and immunity to length-extension attacks. This SHA-512/256 generator hashes text or files locally.

Example

Input:

The quick brown fox jumps over the lazy dog

SHA-512/256 hash:

dd9d67b371519c339ed8dbd25af90e976a1eeefd4ad3d889005e532fc5bef04d

Although both are 64 hex characters long, this is unrelated to SHA-256 of the same input, which is d7a8fbb307d7809469ca9abcb0082e4f…. Always label which algorithm produced a 256-bit hash.

At a glance

Why it exists

SHA-256 and SHA-512 are Merkle–Damgård hashes whose output is their full internal state. That allows a length-extension attack: from H(secret + message) an attacker can compute H(secret + message + padding + extra) without the secret. HMAC avoids the problem, but naïve constructions keep appearing in the wild. SHA-512/256 closes the hole at the algorithm level by hiding half of the state, and it is frequently faster than SHA-256 in software on 64-bit machines.

Where it is used

• OpenZFS, whose sha512 checksum option is implemented as SHA-512/256.
• Blockchain projects such as Algorand, which use SHA-512/256 for addresses and transaction IDs.
• Protocols that want a 256-bit hash with conservative security properties without switching to SHA-3.

A quick test vector: the SHA-512/256 of abc is 53048e2681941ef99b2e29b76b4c7dabe4c2d0c634fc6d46e0e2f13107e7af23. If your library produces this value, it implements the real algorithm rather than a truncated SHA-512.

Because the all-hashes table lists SHA-256 right next to the SHA-512/256 result, it is also a handy way to show colleagues why two “256-bit SHA” values from different systems never match.

Using it in code

OpenSSL: openssl dgst -sha512-256 file. Go: sha512.Sum512_256(data). Java 9+: MessageDigest.getInstance("SHA-512/256"). Python: hashlib.new('sha512_256') where OpenSSL provides it. Note that truncating a normal SHA-512 hash to 64 characters does not produce SHA-512/256.

It is still a fast general-purpose hash, so it is not suitable for passwords; use bcrypt or Argon2id. The hash is computed in your browser.

Three “256-bit SHA” values for the same input

For the input abc, three plausible-looking 64-character results come from three different calculations. Only the last one is SHA-512/256:

The middle row is the common mistake when a library lacks SHA-512/256: truncating the output of SHA-512 skips the different initial values that define the real algorithm. Paste a value into Compare with an expected hash and the tool tells you which of these algorithms produced it.