SHA-512 Hash Generator

What SHA-512 is

SHA-512 is one member of SHA-2, the family NIST published in FIPS 180-2 and revised in FIPS 180-4. People sometimes describe it as 'SHA-256 but longer'. The length is different, and so is the machine word. SHA-256 uses 32-bit words and 512-bit blocks. SHA-512 uses 64-bit words and 1024-bit blocks, which is 128 bytes. The compression function runs 80 rounds. The state is eight 64-bit words. Eight times 64 is 512 bits, hence the name and the 128-character hex string. Because the word size differs, you cannot obtain a SHA-512 digest by running SHA-256 and padding the result, and you cannot obtain SHA-256 by truncating SHA-512. They are separate functions that share a family name and a design style.

NIST also defines truncated variants. SHA-512/256 runs the SHA-512 compression with a different initial state and keeps 256 bits. SHA-512/224 keeps 224 bits. The different initial state is deliberate: a truncated SHA-512 digest must not be the prefix of a full SHA-512 digest of the same message, or the two functions would not be independent. This page computes full SHA-512 only. If a protocol says SHA-512/256, a 128-character string from this page is the wrong width and the wrong function, even though the first 64 hex characters may look plausible. Read the protocol name before you compare.

On 64-bit CPUs, SHA-512 is often faster per byte than SHA-256, because each round mixes twice as much state. That speed is a reason to choose it for large file fingerprints and for deduplication keys. It is also a reason not to choose it for passwords. A password hash should be expensive. SHA-512 of a password, sometimes written as a single round inside an old shadow-password scheme, is not Argon2 and it is not the SHA-512 crypt format that repeats the function thousands of times. A bare 128-character hex string has no salt and no iteration count. Treat it as a fingerprint of bytes, not as a stored credential.

The fixed output is the property that makes comparison easy and storage predictable. A multi-gigabyte disk image and the three letters abc both become 64 bytes. Equality of those 64 bytes is equality of the fingerprints, not a proof that the function is secret or that the file came from a particular author. Anyone can recompute SHA-512. The value of the fingerprint is that a changed bit in the file changes the fingerprint in a way you cannot steer, as far as public cryptanalysis of SHA-2 currently shows. Unlike SHA-1 and MD5, there is no practical collision attack on SHA-512. That is why new checksums should prefer it, or SHA-256, when the publisher lets you choose.

Release artifacts that print 128 hex characters are the width documented here. Shorter printed checksums are a different function: 64 hex characters go to the SHA-256 generator, 40 go to the SHA-1 generator, and 32 go to the MD5 generator. If the publisher signed the bytes with a secret, recompute it on the HMAC generator. When a string arrives with no label at all, the hash identifier reads the length before you pick a page.

Test vector for abc

FIPS 180-4 gives abc, with no line ending, the SHA-512 digest ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f. Count the characters if a copy looks short: there are 128. The page's comparison ignores case, so the same digits in uppercase still match. A truncated paste, even one that is only two characters short, is no match. That is the check you want. A prefix of a digest is not the digest.

The empty message is the second vector worth memorizing, because blank input is a common accident. It hashes to cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e. If the text field looks empty and a file is still attached, you are hashing the file, not the empty message. Clear the file when you mean to reproduce this vector. The three-byte vector and the zero-byte vector together tell you whether a binding is hashing the string you think it is.

Base64 of the abc digest is 3a81oZNherrMQXNJriBBMRLm+k6JqX6iCp7u5ktV05ohkpkqJ0/BqDa6PCOj/uu9RU1EI2Q86A4qmslPpUyknw==. APIs that return a checksum in a JSON string often use this form because it is shorter on the wire than 128 hex characters. Switch Output format to Base64 and paste that string into Expected hash. Hex in the expected field will not match Base64 output. They are two writings of one 64-byte value, and the comparison does not translate between them.

Command-line equivalents

GNU coreutils ships sha512sum. macOS ships shasum -a 512. OpenSSL uses openssl dgst -sha512. All three print lowercase hex. sha512sum and shasum append the filename. OpenSSL wraps the filename in a label. Copy the 128 hex characters into this page and leave the filename behind. For a quick check of the abc vector without a file, printf '%s' abc | shasum -a 512 avoids the newline that echo would append. Hashing a release tarball is sha512sum dist.tar.gz, pointed at the archive itself.

Windows certutil -hashfile dist.tar.gz SHA512 prints the digest with spaces. The expected-hash field on this page strips spaces, so you can paste that line after removing the filename prompt. PowerShell Get-FileHash -Algorithm SHA512 prints uppercase hex. Uppercase still matches the lowercase output of this page when Output format is hex. If you switch this page to Base64, paste a Base64 string, not the PowerShell hex.

sha512sum dist.tar.gz
shasum -a 512 dist.tar.gz
openssl dgst -sha512 dist.tar.gz

Security notes

SHA-512 is an appropriate fingerprint for files, build artifacts, content-addressed storage, and deduplication, provided you do not need a secret. It is not an authentication code. Anyone who can modify the file can recompute the digest and replace the published checksum if they can also modify the place where the checksum is published. Ship the checksum on a separate channel, or sign it. For passwords, use Argon2, bcrypt, or scrypt. A single SHA-512 is too fast, and it has no salt unless you add one yourself in a construction that has been reviewed. Do not invent 'SHA-512 of password plus email' and call it done.

SHA-1 and MD5 are the functions to retire when a protocol still lists them as the checksum. SHA-512 and SHA-256 are the usual replacements. They do not have a practical collision attack. Choose SHA-256 when you must interoperate with a system that already stores 64 hex characters. Choose SHA-512 when you want the larger fingerprint and your verifiers can accept 128 characters. This page will not silently truncate. If a field in your database is sized for SHA-256, a SHA-512 string will not fit, and cutting it down by hand creates a value no standard function will reproduce.

Rules and limitations

UTF-8 for the text field. Raw bytes for a file, capped at 32 MB. A file wins over the text field until it is cleared. Blank text with no file is the empty message, which has the digest quoted above. Hex comparison folds case and drops whitespace. Base64 does not fold case.

The uppercase switch never rewrites Base64. The filename is not mixed into the message. Two artifacts with identical bytes share a digest even when the names differ. The page does not unpack archives.

Common problems

A digest that is 64 hex characters is SHA-256 or another 256-bit function, not a truncated SHA-512 you can fix by switching case. Generate with the function the publisher named. A 96-character hex string is the width of SHA-384, which this page does not compute.

No match on a tarball is often a checksum of the unpacked tree, or a checksum of a different compression pass. Compare byte sizes. A browser re-download that was unzipped by the operating system is no longer the archive the publisher hashed.

Frequently asked questions

About this tool

Maintained by Toolbench. For large or deeply nested files, split the input into smaller batches and verify representative results before using them in an import or application. Report reproducible problems through Contact.