How do I generate a SHA-512/256 checksum from the command line?

SHA-512/256 has no dedicated sum tool on most systems, but OpenSSL handles it anywhere: Linux / Windows / any OS — openssl dgst -sha512-256 filename macOS — shasum -a 512256 filename Windows has no native SHA-512/256 command, so OpenSSL is the practical option. Compare the output to the hash on this page, or paste it into the Verify tab to check it automatically.

SHA-512/256 Hash Generator — Truncated SHA-512 Hashing

SHA-256's output size with SHA-512's speed — the length-extension-resistant hash for key derivation and digital signatures.

Result

Input

Iterations

Hash chaining feeds each digest back in as the next input: H(H(…H(input))). Bitcoin uses double SHA-256 (2). This is not a password KDF — use PBKDF2, bcrypt, or scrypt for passwords.

What is SHA-512/256 Hash?

SHA-512/256 builds a 64-character hash from SHA-512's internals — SHA-512's speed and strength with SHA-256's output size, and no length-extension weakness.

NIST standard — Defined in FIPS 180-4 as part of the SHA-2 family.

64-bit optimized — Uses 64-bit words internally, making it fast on modern 64-bit processors.

Length extension resistant — Unlike SHA-256, it is inherently resistant to length extension attacks (an attacker who knows H(message) cannot compute H(message + extra)).

Same security level as SHA-256 — 256-bit output provides 128-bit collision resistance (two different inputs producing the same hash is called a collision).

Zero-Server Tool Data Guarantee

All hashing happens locally in your browser. Your input is never sent to any server.

How to Use

Enter Your Text

Type or paste the text you want to hash into the input area.

View the Hash

The SHA-512/256 hash is computed instantly as you type. It is displayed as a 64-character hex string.

Verify a Checksum

Switch to the Verify tab and paste a published checksum — openssl dgst -sha512-256 output works too — to confirm it matches the hash of your input.

Copy the Result

Use the copy button to save the hash to your clipboard.

Common Use Cases

Digital Signatures

Provides a 256-bit hash suitable for digital signature algorithms with strong collision resistance.

Key Derivation

Use as the PRF in PBKDF2 for deriving encryption keys or hashing passwords with proper iteration counts.

High-Security Checksums

Generate a compact 64-character hex fingerprint for files and data with a higher security margin than SHA-256.

New Protocol Design

A modern SHA-2 choice when a protocol needs SHA-256-sized output plus inherent length-extension resistance.

Implementation Examples

JavaScriptBrowser (Web Crypto API)

async function sha512_256(message) {
    const msgBuffer = new TextEncoder().encode(message);
    const hashBuffer = await crypto.subtle.digest('SHA-512/256', msgBuffer);
    return Array.from(new Uint8Array(hashBuffer))
        .map(b => b.toString(16).padStart(2, '0')).join('');
}

const hash = await sha512_256('hello world');
// 64 hex characters (256 bits)

SHA-256 vs SHA-512/256 vs SHA-512

Property	SHA-256	SHA-512/256	SHA-512
Output size	256-bit (64 hex)	256-bit (64 hex)	512-bit (128 hex)
Security level	128-bit	128-bit	256-bit
Length extension resistant	No	Yes	Yes
Performance (64-bit)	Fast	Often fastest	Often faster
Performance (32-bit)	Faster	Slower	Slower
NIST standard	Yes (FIPS 180-4)	Yes (FIPS 180-4)	Yes (FIPS 180-4)

Which SHA-2 Size?

SHA-2 size	Output	Collision resistance	Best for
SHA-224	56 hex	112-bit	Legacy compatibility, compact checksums on constrained systems
SHA-256	64 hex	128-bit	General purpose — file integrity, TLS, signatures, blockchain
SHA-512	128 hex	256-bit	Maximum security margin, high-assurance certificates
SHA-512/256You're here	64 hex	128-bit	SHA-256's size with SHA-512's speed — length-extension resistant

All SHA-2 sizes use the Merkle-Damgård construction from NIST FIPS 180-4. SHA-224 truncates SHA-256's output, and SHA-512/256 truncates SHA-512's — which is what gives it length-extension resistance.

Production Best Practices & Security

Don't use for passwords — SHA-512/256 is too fast for direct password hashing; use bcrypt, scrypt, or Argon2 instead. Why:Fast hashing allows attackers to compute billions of hashes per second using GPUs, making brute-force and dictionary attacks trivial against unsalted fast hashes.

Use salt for uniqueness — Identical inputs produce identical hashes; always salt before hashing in security contexts. Why:Without a salt, an attacker can precompute a rainbow table for common inputs and look up millions of hashes at once. Salting forces the attacker to recompute for each individual hash.

Good for key derivation — Use as the underlying hash in PBKDF2 with a high iteration count for password storage. Why:PBKDF2 applies SHA-512/256 thousands of times in sequence, slowing down each guess by the iteration factor and making large-scale brute-force attacks computationally expensive.

Resistant to length extension — Unlike SHA-256, SHA-512/256 is safe for use in HMAC without additional precautions. Why:SHA-256's Merkle-Damgård construction allows attackers to append data to a message and compute a valid hash without knowing the secret key. SHA-512/256's truncated output eliminates this attack vector entirely.

Prefer for new systems — If choosing between SHA-256 and SHA-512/256, prefer SHA-512/256 for its length extension resistance. Why:SHA-512/256 provides the same 256-bit security level as SHA-256 but runs faster on 64-bit processors and eliminates the length extension vulnerability, giving you strictly better security with no trade-offs.

Frequently Asked Questions

SHA-512/256 is a cryptographic hash function defined in FIPS 180-4. It uses SHA-512's internal 64-bit word structure but produces a 256-bit (64-character hex) output.

It is a truncated variant of SHA-512 with different initial hash values, combining the performance benefits of SHA-512's 64-bit operations with the convenience of a 256-bit output.

SHA-512/256 is inherently resistant to length extension attacks (where knowing H(message) doesn't let an attacker compute H(message + extra), unlike SHA-256) because truncation prevents knowing the full internal state.

While both produce the same 256-bit (64-character hex) output size, the internal differences are significant.

SHA-512/256 uses SHA-512's 64-bit word operations and 1024-bit message blocks, making it faster on modern 64-bit CPUs thanks to its 64-bit word operations.

It also resists length extension attacks natively. Truncating the full 512-bit state means an attacker cannot compute H(message || padding || extra) from H(message) alone. SHA-256 requires HMAC or a separate construction to achieve the same property.

No. SHA-512/256 is a cryptographic hash with the same one-way property as all SHA-2 variants.

The 1024-bit Merkle-Damgård compression function discards state at each step, and the additional truncation from 512 bits down to 256 bits further eliminates information.

There is no known method to recover input from a SHA-512/256 digest short of brute-force search, which is computationally infeasible for any input with sufficient entropy.

SHA-512/256 is generally better on modern hardware. It is faster on 64-bit systems (thanks to 64-bit word operations) and provides inherent length extension resistance.

SHA-256 has the advantage of universal support. Every cryptographic library supports it, older 32-bit hardware runs it efficiently, and it has been more extensively studied.

For new systems targeting 64-bit architectures where length extension resistance matters without HMAC overhead, SHA-512/256 is an excellent choice.

Use SHA-512/256 when you need 256-bit output with native resistance to length extension attacks. Unlike SHA-256, truncating the full 512-bit internal state prevents an attacker from computing H(message || padding || extra) from H(message) alone.

It is also faster on 64-bit CPUs thanks to its 64-bit word operations. Choose it for key derivation, digital signatures, and protocols where length extension resistance matters without HMAC overhead.