SHA-512: 512 Bit Digests and 64 Bit Word Arithmetic
SHA-512 is the widest SHA-2 variant, producing 512 bits as 128 hex characters. It uses 64 bit words and 1024 bit blocks, which often makes it faster than SHA-256 on 64 bit CPUs that lack SHA instructions.
At a glance
- Digest size
- 512 bits
- Hex characters
- 128
- Block size
- 1024 bits (128 bytes), 64 bit words, 80 rounds
- Standard
- FIPS 180-4, published alongside SHA-256 in 2001
- Broken for collisions
- No. Nothing close to a practical attack on the full function
- Safe for password storage
- No. Use a memory-hard password hash such as Argon2id, scrypt or bcrypt
- Available in the generator
- Yes, plus HMAC-SHA-512 when a secret is supplied
In detail
SHA-512 shares SHA-256's structure but doubles everything: 64 bit words instead of 32, 1024 bit blocks instead of 512, 80 rounds instead of 64, and eighty round constants derived from the cube roots of the first eighty primes. The result is 128 hex characters, which is long enough that most people who choose it are following a specification rather than a preference.
Its performance surprises people. On a 64 bit CPU without dedicated SHA instructions, SHA-512 processes 128 bytes per compression against SHA-256's 64, using native register width, and commonly runs 30 to 50 percent faster per byte. On hardware with SHA-256 extensions the ordering reverses sharply, because those instructions accelerate SHA-256 and not SHA-512. Measure on your target rather than assuming.
The extra output width is not extra practical security. A 256 bit digest already puts a birthday collision at 2^128 operations, which no amount of hardware reaches. SHA-512 is worth choosing for a genuine reason: matching a protocol requirement, feeding a key derivation function that wants 512 bits of input entropy, or pairing with a scheme that specifies it, such as Ed25519 which uses SHA-512 internally.
It shares SHA-256's length extension weakness. Publishing SHA-512(secret + message) lets an attacker append data and produce a valid digest for the extended message without the secret. If you need authentication rather than a fingerprint, use HMAC-SHA-512, or switch to SHA-384, which is truncated and therefore immune.
SHA-512 is also the base of the crypt(3) scheme identified by the $6$ prefix in /etc/shadow on many systems. That scheme applies thousands of iterations and a salt on top of SHA-512; the underlying hash is not doing the protective work. Do not imitate it in application code. Use Argon2id, scrypt or bcrypt for passwords. ToolBox has no password hashing tool and this generator is not a substitute.
Examples
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921
d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81
a538327af927da3eShown wrapped. The real digest is 128 unbroken hex characters.
ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee6
4b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e
2a9ac94fa54ca49f$6$rounds=656000$<salt>$<hash>
$1$ = MD5 crypt $5$ = SHA-256 crypt
$6$ = SHA-512 crypt $2y$ = bcrypt
The $6$ scheme iterates SHA-512 with a salt. A bare SHA-512
digest in a password column is not this and is not safe.Things that catch people out
- Choosing SHA-512 over SHA-256 for security reasons is almost always cargo cult. Choose it for a protocol requirement or a measured performance win, not for the bigger number.
- SHA-512 truncated to 256 bits is not SHA-512/256. The standardised SHA-512/256 uses different initial constants, exactly as SHA-384 does.
- Length extension applies here just as it does to SHA-256. A homemade signature of hash(secret + body) is forgeable regardless of how wide the digest is.
- A 128 character hex string in a database column defined as VARCHAR(64) silently truncates in some configurations, which turns every comparison into a false negative. Size the column to 128 characters, or store the 64 raw bytes.
Try it: Hash Generator
Paste text or drop a file and get every digest at once, in hex or Base64, with a verify tab for comparing an expected value against what you actually have.
Hash Generator
LOCAL · Browser-OnlyGenerate MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, Keccak-256, CRC32, and HMAC hashes from text or files
MD5 is cryptographically broken and should not be used for security purposes. Use SHA-256 or SHA-512 instead.
Related Hash algorithms
All hash algorithms →SHA-384: Truncated SHA-512 and Why the Truncation Helps
SHA-384 is SHA-512 with a different starting state, cut to 384 bits. That truncation removes the length extension weakness. 96 hex characters explained.
SHA-256: The Default Choice and How It Is Used
SHA-256 gives a 64 character hex digest with no practical collision or preimage attack. Where it belongs, where it does not, and its length extension flaw.
HMAC-SHA-512: 512 Bit Tags, HS512 Tokens and Key Sizing
HMAC-SHA-512 produces a 128 character tag. How HS512 tokens use it, why key length is capped by the 128 byte block, and when the width is wasted.
SHA3-512: Maximum Sponge Capacity and When to Choose It
SHA3-512 outputs 128 hex characters and holds back 1024 bits of capacity, halving throughput versus SHA3-256. What that buys and when it is worth it.
SHA3-256: The Sponge Construction and How It Differs From SHA-256
SHA3-256 gives the same 64 hex characters as SHA-256 from a completely different construction. No length extension, different failure modes, FIPS 202.
Keccak-256: Ethereum's Hash and Why It Is Not SHA3-256
Keccak-256 uses the original Keccak padding, not the FIPS 202 padding. Same 64 hex characters as SHA3-256, completely different values. Why Ethereum uses it.
Tools for this
- Hash Generator Free online hash generator - generate MD5, SHA-1, SHA-256 hashes from any input text