What Is SHA?  

What Is A Hash Function?

To understand SHA, we first need to understand what a hash function is. In essence, hash functions take an input (usually a message of some kind) and produce a fixed-length output called a digest, or hash. In the case of SHA-2 hashes, they are expressed in depths of 224, 256, 384, or 512 bits.

Unlike AES-256, which is symmetric block cipher encryption used for protecting the data communicated between two parties, hash functions are purpose-built for the task of handling one-way identity checks that need to be verified. This makes it a prime candidate for integrity checks like digital signatures, TLS/SSL certificates, passwords, and securing transactions on the blockchain.

Think of block cipher encryption as a safe deposit box, and hash functions as tamper-proof seals attached to the lock. Hash functions verify that no one has tampered with the contents of the safety deposit box between the first party locking something in the box and the second party unlocking it to retrieve it.

On a technical level, the hashing process involves padding the input data to a specific size, breaking it into blocks, and feeding those blocks through many complex mathematical "rounds" (64 rounds for SHA-256, 80 for SHA-512) to scramble the bits into the final hash.

For example, if your input is "hello", the SHA-256 hash for that word will be "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824". Like most modern cryptographic techniques, it's simple for a device to scramble "hello" into that string, but almost computationally impossible to descramble it to recover the original word, since there are 2^256 potential solutions.

What Is SHA-2?

First developed by the NSA and published by NIST in 2001, SHA-2 was the successor to Secure Hash Algorithm-1, launched in 1995.

SHA-1 was initially deployed to act as the signatory for the early internet, providing the cryptographic backbone for everything from SSL browser certificates to version control systems like Git. At the time, SHA-1's 160-bit hash layer was considered perfectly secure, though cracks like the infamous brute-force Birthday Attack started being proposed in research circles around the late 90s.

The structural weakness with hash functions is the issue known as "collision." Collision happens purely by coincidence when two different inputs produce the exact same hashed output. Continuing the earlier metaphor, a duplicated hash function would allow hackers to create forged seals on a safe deposit box. In that example, they could use the forged seal to convince the receiving party that the contents of the deposit box are genuine, when in reality they've been tampered with during transit.

As SHA-1 began to show its age, the NIST and NSA recognized a need for a modernized hash function to replace it. SHA-2 was developed and published in a joint effort by both organizations in 2001. By applying greater bit depths to each hash function, SHA-256 created stronger layers of security that, like its cousin AES-256, contains more possible solutions to each hash than there are individual atoms in the observable universe.

Though adoption was slow throughout the early millennium, everything changed in 2017 when the SHAttered attack (learn more about that attack here) was identified by teams at Google and CWI Amsterdam. SHAttered was able to solve the 160-bit hash of SHA-1 through collision, prompting the broader security community to thicken the wall between the hash solution and anyone out there who might be looking for it.

SHA-2 wasn't a reinvention of the wheel compared to SHA-1. Instead, it just added more complexity and difficulty to the same underlying mathematical principles, which remain robust to this day.

SHA-3 Enters the Fray

Determined never to be caught out by another SHAttered attack, the NIST set out to find an alternative to traditional SHA hashing methods back in 2007. By 2012, after a global competition to discover a brand new hash algorithm, the winner, "Keccak", was crowned.

In 2015, Keccak was officially standardized by the NIST as SHA-3. These days, SHA-3 remains relatively underused compared to SHA-2 due to its slower performance and structural differences that require specialized implementation. That said, SHA-2 is still widely considered safe, and no attacks equivalent to SHAttered have yet been discovered that could theoretically compromise it.

Where Is SHA-2 Used Most Commonly?

If you interact with the internet in 2025, you likely use SHA-2 in one form or another. The most common places SHA-2 is deployed include:

• Secure Web Browsing (SSL/TLS): When you see the padlock icon and "https" in your browser, SHA-2 is used to verify the website's digital certificate. This ensures you're connected to the real website (like your bank) and not an impostor.
• Passwords: Whenever you create an account and set a new password with a website or service, they don't (or shouldn't, at least) store the details in plaintext on their servers. Instead, the password is passed through SHA-256, creating a unique hash that can't be decrypted even if a hacker gains backend access to the servers.
• Blockchain and Cryptocurrencies: SHA-256 is the backbone of Bitcoin. It's used to secure the "blocks" in the blockchain (proof-of-work) and to verify transactions.
• Data Integrity: When you download a large software file, companies often provide a SHA-2 hash for it. After downloading, you can run a check to see if your hash matches the one provided. If it does, you know the file wasn't corrupted or tampered with during the download.
• Digital Signatures: Used to verify that a digital document (like a PDF) or message is authentic and hasn't been altered.

Conclusion

SHA-2 represents yet another seemingly invisible, but structurally integral pillar in the internet cryptographic ecosystem that makes our modern communication networks possible.

By verifying the contents of our data and thwarting would-be impostors, SHA-2 allows for unknown parties to safely and securely exchange data across any distance.