SHA-256 works by padding a message to a multiple of 512 bits, breaking it into blocks, and mixing each block into a 256-bit running state through 64 rounds of additions, rotations, and bitwise logic, so that the final state depends on every bit of the input. The algorithm sounds intimidating, but its shape is simple: prepare the message, then repeatedly stir each chunk into an internal state until nothing about the input can be untangled from the result. This walkthrough follows that pipeline stage by stage, in plain terms, so you can see why the output is fixed-size, why a one-bit change scrambles everything, and why running it backwards is hopeless.
What is SHA-256 at a high level?
At a high level, SHA-256 is a compression pipeline that turns any message into a 256-bit fingerprint. It belongs to the SHA-2 family and always outputs 256 bits, shown as 64 hexadecimal characters. The design is what cryptographers call a Merkle-Damgard construction: it maintains a fixed-size internal state, and it folds the message into that state one block at a time using a compression function.
The whole process has three phases. First, padding reshapes the message so its length is an exact multiple of 512 bits. Second, the padded message is split into 512-bit blocks. Third, each block is processed by the compression function, which updates the running 256-bit state. When the last block has been folded in, the state is the digest. Everything technical is just the detail of how one block is mixed into the state.
How does the padding step work?
Padding makes the message length a multiple of 512 bits and records the original length inside the data. This matters for two reasons: the block-processing loop needs whole 512-bit blocks with nothing left over, and including the length prevents different messages from lining up to the same padded form. The rule is fixed and deterministic, so the same message always pads identically.
The procedure appends, in order: a single 1 bit, then as many 0 bits as needed, then a 64-bit field holding the original message length in bits. The zeros are chosen so the grand total lands on the next multiple of 512.
Original message: L bits
Append: one 1 bit
Append: K zero bits (smallest K making it fit)
Append: 64-bit value = L
Total: (L + 1 + K + 64) is a multiple of 512Because the length is baked into the padding, a short message and a longer one can never accidentally produce identical padded input, which closes off a whole class of trivial collisions. The mandatory 1 bit also guarantees the padding is unambiguous, so a decoder always knows where the real message ended.
What is the internal state?
The internal state is eight 32-bit words, 256 bits in total, that start from fixed constants and get updated by every block. These eight words are usually labelled a through h. Their initial values are not arbitrary; they are derived from the fractional parts of the square roots of the first eight prime numbers, a standard trick to produce “nothing-up-my-sleeve” constants with no hidden structure.
SHA-256 also uses a table of 64 round constants, similarly derived from the cube roots of the first 64 primes. As each block is processed, the eight state words are transformed in place, and after the block the new state is carried forward to the next one. Since the state is exactly 256 bits and never grows, the output stays fixed-size no matter how many blocks the message required. The final values of these eight words, concatenated, are the digest.
What happens inside one block?
Inside each block, SHA-256 expands the 512-bit block into 64 words and runs 64 rounds that scramble the state. First comes the message schedule: the 512-bit block is split into sixteen 32-bit words, and those are extended to 64 words, where each new word is computed from earlier ones using rotations, shifts, and additions. This ensures every part of the block influences many rounds, not just one.
Then come the 64 rounds. In each round, the eight state words are combined with one scheduled word and one round constant through a fixed recipe of operations, all working on 32-bit values with addition performed modulo 2 to the 32nd power:
| Operation | Role in a round |
|---|---|
| Modular addition | Combines values while wrapping at 32 bits, mixing carries |
| Bitwise rotation | Moves bits so local changes spread across the word |
| Bitwise shift | Used in the message schedule to diffuse bits |
| Choice and majority functions | Nonlinear logic that makes the mixing hard to invert |
| XOR | Blends bit patterns without simple carries |
After all 64 rounds, the transformed working values are added back into the state words the block started from. This feed-forward addition is important: it means each block’s contribution is combined with, not merely replaced by, the previous state, which strengthens the one-way property. The updated state then moves on to the next block, and the cycle repeats until every block is consumed.
Why can’t SHA-256 be reversed?
SHA-256 cannot be reversed because its operations deliberately destroy information and mix bits beyond untangling. Modular addition throws away carry bits that overflow 32 bits; the choice and majority functions are nonlinear and lose track of which inputs produced a given output; and 64 rounds of rotation and XOR spread every input bit across the entire state. To run the function backwards you would have to undo all of that with only the final 256 bits to work from, and the discarded information is simply gone.
This is the avalanche effect in action. Change one bit anywhere in the input and the padding, message schedule, and rounds propagate that change until roughly half of the 256 output bits differ, with no visible pattern linking the input change to the output change. The practical upshot is that the only way to find an input matching a given digest is to guess inputs and hash them, which for any real input space is infeasible. That is precisely what makes SHA-256 useful for integrity and signatures: a matching digest is strong evidence of matching content.
How can you see SHA-256 in action?
The best way to build intuition is to hash a string, change one character, and watch the entire digest transform. You can do exactly that with our hash generator, which computes SHA-256 in your browser so you can observe the fixed 64-character output and the avalanche effect directly. Because it runs client-side, the text you hash never leaves your machine, which is the sensible default whenever the input might be sensitive.
Two closing cautions keep you on the right side of good practice. SHA-256 remains secure for integrity, signatures, and content addressing, with no known practical collision or preimage attack, so it is a reliable default when a hash must be trustworthy. But its speed makes it wrong for password storage, where you want a deliberately slow, salted function like bcrypt, scrypt, or Argon2. Understand the pipeline, padding, blocks, state, and 64 rounds of mixing, and SHA-256 stops being a black box and becomes a well-understood tool you can apply with confidence. For the broader theory behind why these properties matter, see the companion piece on what a cryptographic hash function is.