Cryptographic Hash Functions

How does a message of any length become a 32-byte digest? In SHA-256, its bytes pass through a small set of operations, repeated enough times that each part of the input can influence the whole result.

We will follow that calculation in four stages: prepare the bytes → expand the message → mix the state → assemble the digest. SHA-256 is our concrete example; Keccak-256 ⁠, used by Ethereum, follows a different construction.

Everything becomes bytes

Text is encoded, files are read, and structured objects are serialized. By the time data reaches SHA-256, it is a sequence of bytes. The hash calculation does not need to know which format it came from.

These paths produce the same kind of representation, not identical content. An image file's bytes include its format and metadata; hashing a decoded image is a different choice. Structured data needs an agreed serialization so the same object produces the same bytes.

Drag the length slider to follow a shorter or longer input through every step. The sample repeats the letters a–z, one UTF-8 byte per letter. The length is measured before padding; zero means an empty input. All length controls below share this same input. The byte preview pairs each letter with its hexadecimal value. Every interactive figure labels the current input; reset returns to abc.

Input \cdot abc \cdot 61 62 63 Reset to abc

Input length3 B

Text → UTF-8Letter / hex

a61

b62

c63

Make complete blocks

SHA-256 reads 64 bytes at a time. Before processing, it adds an ending that makes the message fill a whole number of blocks.

For a byte-aligned message, append 80, enough zero bytes, and finally eight bytes recording the original bit length. The 80 byte is a 1 bit followed by seven zeros; it marks where the message ends. The length field records how long the original message was.

Each position below is one byte. Dark circles show the actual input bytes in hex. The blue-violet marker is 80, hollow dots are zero padding, and the final eight outlined cells encode the original bit length, most-significant byte first. The shaded outline groups all padding, including the length field. Each block holds 64 bytes.

Input \cdot abc \cdot 61 62 63 Reset to abc

Input length3 B

Block 0164 B · hex bytes

Length · 24 bits

Input 3 BPadding 61 B

Move the input slider between 55 and 56 bytes. At 55, the ending fits in one block: $55+1+8=64$ . At 56, it spills into a second block. At 64 input bytes, the message fills a block exactly, so its ending needs a new block of its own.

The padding equation

For an original bit length $\ell$ , append one 1 bit and the smallest nonnegative number $k$ of zero bits such that:

\ell+1+k\equiv448\pmod{512}

Append the 64-bit encoding of $\ell$ to reach a multiple of 512 bits.

Work in small words

Split each 64-byte block into sixteen words, each four bytes long. A word is just a 32-bit number. Read the most significant byte first, so 61 62 63 80 becomes the word 61626380.

SHA-256 uses a few operations on these words:

Add: keep the low 32 bits if the result overflows. For example, ffffffff + 00000001 = 00000000.
XOR: compare corresponding bits; output 1 when they differ.
Rotate or shift: move bits to different positions. Rotation wraps them around; a shift discards them and fills with zeros.

Rotate / shift \cdot fixed 8-bit example

Right 1

This illustration uses a fixed eight-bit value, independent of the message, so the movement is easy to see. SHA-256 does the same operations on 32 bits.

Rotations move an input bit to other positions. Addition brings in carries: even 0111 + 0001 = 1000 changes several bits. Combining these operations lets a local difference spread as the computation proceeds.

We will write XOR as $\oplus$ and wrapping addition as $\boxplus$ :

x\boxplus y=(x+y)\bmod 2^{32}

Expand the message

Each block goes through 64 rounds, and each round needs one message word. We have sixteen words so far. To get the remaining 48, SHA-256 repeatedly combines four earlier words.

Call the word for round $t$ $W_t$ . The first sixteen come straight from the selected block, four bytes per word. They include padding bytes when those fall inside the block.

From word 16 onward:

W_t=\sigma_1(W_{t-2})\boxplus W_{t-7} \boxplus\sigma_0(W_{t-15})\boxplus W_{t-16}

The two $\sigma$ functions mix a word by XORing rotated and shifted copies of it. Two of the four earlier words pass through these functions; the other two enter the sum unchanged.

Input \cdot abc \cdot 61 62 63 Reset to abc

W[16]

σ₁(W[14])00000000

W[9]00000000

σ₀(W[1])00000000

W[0]61626380

W[16]61626380Sum mod 2³²

Move the word slider to see which four earlier words contribute. Change the input length or the selected block to follow a different calculation. This is the message schedule: it keeps reintroducing the input in different combinations across the rounds. It creates dependencies, not extra information.

Exact rotation and shift amounts

$\operatorname{ROTR}_r(x)$ rotates right by $r$ bits; $\operatorname{SHR}_r(x)$ shifts right and fills with zeros.

\begin{aligned} \sigma_0(x)&=\operatorname{ROTR}_7(x)\oplus\operatorname{ROTR}_{18}(x)\oplus\operatorname{SHR}_3(x)\\ \sigma_1(x)&=\operatorname{ROTR}_{17}(x)\oplus\operatorname{ROTR}_{19}(x)\oplus\operatorname{SHR}_{10}(x) \end{aligned}

These fixed amounts are part of SHA-256's design.

Mix eight working words

Alongside the message schedule, SHA-256 keeps eight working words named $a,b,c,d,e,f,g,h$ . Together they hold 256 bits. Think of them as eight slots whose contents change every round.

The first block starts with eight fixed values. Each round reads one schedule word $W_t$ and a fixed round constant $K_t$ , then computes two temporary values:

\begin{aligned} T_1&=h\boxplus\Sigma_1(e)\boxplus\operatorname{Ch}(e,f,g)\boxplus K_t\boxplus W_t\\ T_2&=\Sigma_0(a)\boxplus\operatorname{Maj}(a,b,c) \end{aligned}

There are three small ideas inside these equations. $\Sigma$ mixes bit positions using rotations and XOR. Choose, $\operatorname{Ch}$ , uses each bit of $e$ to select a bit from $f$ or $g$ . Majority, $\operatorname{Maj}$ , takes whichever bit appears at least twice among $a,b,c$ .

The update is simpler than the equations suggest: six words move to the next slot; two receive newly mixed values.

a_{\text{new}}=T_1\boxplus T_2, \qquad e_{\text{new}}=d\boxplus T_1

Input \cdot abc \cdot 61 62 63 Reset to abc

Round 0

Round arithmetic

T₁ = 54da50e8 · T₂ = 08909ae5a′ = 54da50e8 + 08909ae5 = 5d6aebcde′ = a54ff53a + 54da50e8 = fa2a4622

The arrows show where each new value comes from. All eight updates use the old state. The message enters through $T_1$ , affects both $a$ and $e$ , then moves through the other slots in later rounds.

Expand “Round arithmetic” to see the two additions for the selected round. The next round repeats the same rule with the updated state and the next schedule word. After 64 rounds, all eight words have been repeatedly mixed.

Boolean functions and constants

Here $\land$ means bitwise AND and $\neg$ flips all 32 bits. Choose and majority operate independently at each bit position:

\begin{aligned} \operatorname{Ch}(x,y,z)&=(x\land y)\oplus(\neg x\land z)\\ \operatorname{Maj}(x,y,z)&=(x\land y)\oplus(x\land z)\oplus(y\land z) \end{aligned}

The uppercase $\Sigma$ functions used in rounds differ from the lowercase $\sigma$ functions used in the schedule:

\begin{aligned} \Sigma_0(x)&=\operatorname{ROTR}_2(x)\oplus\operatorname{ROTR}_{13}(x)\oplus\operatorname{ROTR}_{22}(x)\\ \Sigma_1(x)&=\operatorname{ROTR}_6(x)\oplus\operatorname{ROTR}_{11}(x)\oplus\operatorname{ROTR}_{25}(x) \end{aligned}

The initial eight words are:

TEXT

6a09e667 bb67ae85 3c6ef372 a54ff53a
510e527f 9b05688c 1f83d9ab 5be0cd19

They come from the first 32 fractional bits of the square roots of the first eight primes. The 64 round constants come from cube roots of the first 64 primes; $K_0$ is 428a2f98. These values are fixed and public. Their origin makes them reproducible, not a proof of security. Curve Origins ⁠ examines that distinction for elliptic-curve parameters.

Add back and join

One step remains after round 63. Add each final working word to the corresponding word from before this block began, again keeping only 32 bits. This is called feed-forward.

For each of the eight positions:

\text{output word}=\text{incoming word}\boxplus\text{final working word}

Input \cdot abc \cdot 61 62 63 Reset to abc

Incoming H[0]6a09e667

Final a506e3058

H[0] · mod 2³²ba7816bf

SHA-256 digest8 × 4 B = 32 B

Select a word to see its addition and its place in the block output. On the last block, joining the eight results gives the final 32-byte digest. Earlier blocks produce an intermediate state instead.

For a longer message, those eight results become the starting state for the next block. Build that block's schedule, run 64 rounds, and add back again. Only after the last block do we serialize the state as the digest.

Why the mixing matters

A changed input bit enters both the schedule and the working state. Rotations move its influence across bit positions; Boolean selection and carries make the effect depend on the surrounding values. Repetition spreads that influence across the output. The avalanche effect emerges from this process.

This explains how the mixing happens, but it does not prove that reversing the hash is hard. A rotation, for example, is easy to undo. The difficult problem is finding an unknown message that satisfies the entire linked calculation when only the final digest is given. SHA-256's security depends on how well this specific construction withstands cryptanalysis.

For the full specification, see FIPS 180-4, sections 4–6.