SHA Algorithms Explained: From SHA-1 to SHA-3

The Fingerprint of Digital Data

Every file, every message, and every piece of data on the internet can be reduced to a short, fixed-length string of characters that uniquely identifies it. This is the power of cryptographic hash functions, and the most important family of these functions is SHA—the Secure Hash Algorithm.

SHA is not a single algorithm. It is a family of algorithms that have evolved over three decades, each generation responding to the weaknesses discovered in its predecessor. From the deprecated SHA-1 to the modern SHA-3, understanding this evolution is essential for anyone working with digital security.

In this guide, we will trace the history of the SHA family, explain how each algorithm works, compare their strengths and weaknesses, and help you choose the right one for your needs.

---

What Is a Hash Algorithm?

Before diving into the SHA family, let’s establish what a hash algorithm does. A cryptographic hash function takes an input of any size and produces a fixed-length output called a hash or digest.

Five Properties of Secure Hash Functions

Property	What It Means	Why It Matters
Deterministic	Same input always produces the same output	Enables verification and comparison
Pre-image Resistance	Cannot reverse a hash to find the original input	Protects stored passwords and secrets
Collision Resistance	Cannot find two inputs that produce the same hash	Prevents forgeries and data tampering
Avalanche Effect	Small input change produces completely different output	Prevents partial information leakage
Fast Computation	Hash can be calculated quickly	Enables real-time verification

Understanding these properties helps you evaluate why SHA-1 was abandoned and why SHA-256 remains the industry standard. You can compute SHA-256 hashes locally using our SHA-256 Generator.

---

The SHA Family Timeline

Algorithm	Year	Output Size	Designer	Status
SHA-0	1993	160 bits	NSA / NIST	Withdrawn (flawed)
SHA-1	1995	160 bits	NSA / NIST	Deprecated (collision attacks)
SHA-224	2001	224 bits	NSA / NIST	Secure
SHA-256	2001	256 bits	NSA / NIST	Secure (industry standard)
SHA-384	2001	384 bits	NSA / NIST	Secure
SHA-512	2001	512 bits	NSA / NIST	Secure
SHA-3	2015	224/256/384/512 bits	NIST / Keccak team	Secure (different design)

---

SHA-0 and SHA-1: The Fallen Giants

SHA-0 (1993)

SHA-0 was the first algorithm in the SHA family, published by NIST in 1993. It produced a 160-bit hash and was based on the MD4 design. However, SHA-0 had a critical design flaw: it did not perform any bit rotation in its compression function, making it weaker than intended.

SHA-0 was withdrawn after just two years and replaced by SHA-1. It is now considered completely broken and should never be used.

SHA-1 (1995)

SHA-1 corrected SHA-0’s flaws and became the most widely used hash algorithm for over a decade. It produces a 160-bit hash (40 hexadecimal characters) and was used in SSL/TLS certificates, digital signatures, Git version control, and file integrity checks.

The Death of SHA-1

Year	Attack	Significance
2005	Theoretical collision (Wang et al.)	First academic proof that SHA-1 is not collision-resistant
2006	NIST deprecates SHA-1	NIST recommends migrating to SHA-2
2012	Flame malware uses SHA-1 collision	Nation-state attack exploits SHA-1 weakness
2017	SHAttered attack (Google + CWI)	First practical SHA-1 collision demonstrated
2020	SHA-1 collisions generated in seconds	Attack becomes trivial on consumer hardware

The SHAttered Attack: In 2017, researchers at Google and CWI Amsterdam created two different PDF files with the same SHA-1 hash. This proved that SHA-1 is no longer collision-resistant. The attack cost approximately $110,000 in cloud computing resources—expensive for a researcher, trivial for a nation-state.

SHA-1 Example Output

Input:  "The quick brown fox jumps over the lazy dog"
SHA-1:  2fd4e1c67a2d28fced849ee1bb76e7391b93eb12

The 40-character hexadecimal string represents 160 bits of data. While this may seem like a lot, $2^{80}$ operations (the birthday attack complexity) are within reach of modern computing clusters.

---

SHA-2: The Current Standard

SHA-2, published in 2001, is a family of hash algorithms with different output sizes. It was designed by the NSA and standardized by NIST in FIPS 180-2 (later updated to FIPS 180-4).

SHA-2 Variants

Algorithm	Output Size	Hex Characters	Block Size	Rounds	Security Level
SHA-224	224 bits	56	512 bits	64	112-bit
SHA-256	256 bits	64	512 bits	64	128-bit
SHA-384	384 bits	96	1024 bits	80	192-bit
SHA-512	512 bits	128	1024 bits	80	256-bit
SHA-512/224	224 bits	56	1024 bits	80	112-bit
SHA-512/256	256 bits	64	1024 bits	80	128-bit

How SHA-256 Works (Simplified)

SHA-256 uses a Merkle-Damgård construction with a compression function:

1. Padding: The input is padded so its length is a multiple of 512 bits.
2. Initialization: Eight 32-bit hash values (H0-H7) are initialized from the fractional parts of the square roots of the first eight primes.
3. Compression: Each 512-bit block is processed through 64 rounds of bitwise operations, modular addition, and constants derived from cube roots of primes.
4. Output: The final values of H0-H7 are concatenated to produce the 256-bit hash.

You can see the difference between SHA-256 and other hash algorithms in our MD5 vs SHA-256 Comparison.

SHA-256 Example

Input:  "The quick brown fox jumps over the lazy dog"
SHA-256: 7d38b8c1f3b63daf14e13d6335b3f3e1d3b8b5b1b3b7b9b5b1b3b7b9b5b1b3b7

Why SHA-256 Is the Industry Standard

• No known collisions: As of 2026, no one has found two different inputs with the same SHA-256 hash.
• Wide adoption: Used in TLS/SSL, Bitcoin, Git, code signing, and password hashing (with bcrypt/scrypt/Argon2).
• Quantum-resistant (practical): Grover’s algorithm reduces SHA-256’s security from 256-bit to 128-bit, which is still considered secure.
• Efficient hardware support: Modern CPUs include SHA-NI instructions that accelerate SHA-256 computation by 5-10x.

---

SHA-3: The Fresh Alternative

SHA-3 was standardized by NIST in 2015 after a public competition that ran from 2007 to 2012. The winning algorithm, Keccak, was designed by Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche.

How SHA-3 Differs from SHA-2

Property	SHA-2 (Merkle-Damgård)	SHA-3 (Keccak Sponge)
Construction	Merkle-Damgård	Sponge construction
Internal State	256 bits (for SHA-256)	1600 bits
Round Function	Boolean operations (AND, OR, XOR)	Bitwise permutation (θ, ρ, π, χ, ι)
Length Extension Attack	Vulnerable (mitigated in HMAC)	Not vulnerable
Parallelism	Sequential	Naturally parallelizable

The Sponge Construction

SHA-3 uses a sponge construction, which works in two phases:

1. Absorb: Input blocks are XORed into the internal state, and a permutation function is applied after each block.
2. Squeeze: Output blocks are extracted from the internal state, with the permutation applied between each output block.

The 1600-bit internal state of SHA-3 provides a large security margin. Even if a partial attack is found on part of the state, the remaining state provides redundancy.

SHA-3 Variants

Algorithm	Output Size	Security Level	Use Case
SHA3-224	224 bits	112-bit	Constrained environments
SHA3-256	256 bits	128-bit	General-purpose (replacement for SHA-256)
SHA3-384	384 bits	192-bit	High-security applications
SHA3-512	512 bits	256-bit	Maximum security

When to Use SHA-3

SHA-3 is recommended when:

• You need a different algorithm family as a backup to SHA-2 (defense in depth).
• Your application requires resistance to length extension attacks without HMAC.
• You want to future-proof against potential SHA-2 weaknesses.
• Your hardware supports SHA-3 acceleration.

---

Complete Algorithm Comparison

Algorithm	Output	Hex Chars	Block Size	Construction	Collision Security	Status
MD5	128 bits	32	512 bits	Merkle-Damgård	Broken	Deprecated
SHA-1	160 bits	40	512 bits	Merkle-Damgård	Broken	Deprecated
SHA-224	224 bits	56	512 bits	Merkle-Damgård	Secure	Current
SHA-256	256 bits	64	512 bits	Merkle-Damgård	Secure	Current
SHA-384	384 bits	96	1024 bits	Merkle-Damgård	Secure	Current
SHA-512	512 bits	128	1024 bits	Merkle-Damgård	Secure	Current
SHA3-256	256 bits	64	1088 bits	Sponge	Secure	Current

Performance Comparison (Single-Core, Modern CPU)

Algorithm	Speed (MB/s)	Cycles/Byte	Hardware Acceleration
MD5	~700	~0.5	No
SHA-1	~600	~0.6	SHA-NI (limited)
SHA-256	~500	~0.8	SHA-NI (Intel/AMD)
SHA-512	~400	~1.0	SHA-NI (Intel/AMD)
SHA3-256	~300	~1.5	Limited (ARMv8)

---

Real-World Applications

SHA-256 Applications

Application	How SHA-256 Is Used
TLS/SSL Certificates	Verifies certificate integrity and chains of trust
Bitcoin	Proof-of-work mining, Merkle tree construction, address generation
Git	Identifies commits and objects (migrating from SHA-1)
Code Signing	Verifies software has not been tampered with
File Integrity	Checksums for software distribution (e.g., Linux ISOs)
HMAC	Message authentication with shared secret keys

SHA-3 Applications

Application	How SHA-3 Is Used
Ethereum	Keccak-256 for transaction hashing and address generation
Post-Quantum Cryptography	Component in CRYSTALS-Kyber key encapsulation
Government Systems	Required by some agencies as SHA-2 alternative
Smart Contracts	Event logging and state verification

When NOT to Use SHA for Passwords

Important: SHA algorithms (all variants) are too fast for password hashing. An attacker with a modern GPU can compute billions of SHA-256 hashes per second. For password storage, use specialized algorithms:

Password Hasher	Type	GPU Resistance	Recommendation
bcrypt	Adaptive	Good	Recommended
scrypt	Memory-hard	Very good	Recommended
Argon2	Memory-hard + time	Excellent	Best choice
SHA-256	Fast hash	Poor	Do not use for passwords

Generate strong passwords with our Password Generator and check their strength with our Entropy Calculator.

---

Migration Guide: SHA-1 to SHA-2/SHA-3

If your system still uses SHA-1, here is how to migrate:

Step 1: Audit SHA-1 Usage

grep -r "sha1\|SHA-1\|SHA1" --include="*.js" --include="*.py" --include="*.conf" .

Step 2: Prioritize by Risk

SHA-1 Usage	Risk Level	Action
Digital signatures	Critical	Replace immediately with SHA-256
TLS certificates	Critical	Use SHA-256 certificates (free from Let’s Encrypt)
Password hashing	Critical	Migrate to bcrypt/scrypt/Argon2
File integrity checks	Moderate	Replace with SHA-256
Git commits	Low	Git is migrating to SHA-256 automatically
Cache keys	Low	Optional replacement

Step 3: Verify Compatibility

Ensure all systems in your pipeline support SHA-256 or SHA-3. Most modern systems do, but legacy embedded devices or older APIs may need updates.

Step 4: Update Hash Generation

Replace SHA-1 hash generation with SHA-256:

# Before (INSECURE)
import hashlib
hashlib.sha1(b"data").hexdigest()

# After (SECURE)
import hashlib
hashlib.sha256(b"data").hexdigest()

You can verify hash outputs using our Hash Identifier tool.

---

Frequently Asked Questions

Is SHA-256 the same as SHA-2?

SHA-256 is one algorithm within the SHA-2 family. SHA-2 includes SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. When people say "SHA-2," they usually mean SHA-256, which is the most commonly used variant.

Should I use SHA-256 or SHA-3?

For most applications, SHA-256 is the recommended choice due to its wide support, proven security track record, and hardware acceleration. SHA-3 is an excellent alternative if you need defense-in-depth, resistance to length extension attacks, or if your specific use case benefits from the sponge construction.

Can SHA-256 be reversed?

No. SHA-256 is a one-way hash function. It is computationally infeasible to reverse the process and recover the original input. The only approach is brute force, which for 256 bits would require approximately $2^{256}$ operations—more than the number of atoms in the observable universe.

Why was SHA-1 deprecated?

SHA-1 was deprecated because researchers demonstrated practical collision attacks. In 2017, Google and CWI Amsterdam created two different PDF files with the same SHA-1 hash (the SHAttered attack), proving that SHA-1 is no longer collision-resistant. By 2020, collisions could be generated in seconds.

Are SHA algorithms quantum-resistant?

Symmetric SHA algorithms (SHA-256, SHA-3) are partially quantum-resistant. Grover's algorithm reduces their effective security by half: SHA-256 becomes 128-bit secure, and SHA-384 becomes 192-bit secure. Both are still considered computationally secure against brute-force attacks, even with quantum computers.

What is the difference between SHA-2 and SHA-3?

SHA-2 uses a Merkle-Damgård construction, while SHA-3 uses a Keccak sponge construction. SHA-3 is not a successor to SHA-2; they are parallel alternatives with different internal structures. SHA-3 provides defense-in-depth in case a weakness is ever found in SHA-2's construction.

---

About the Author

The GeneratePass Editorial Team builds privacy-first security tools that run entirely in your browser. Every tool on GeneratePass processes data locally — nothing is ever sent to a server. Visit generatepass.me to try our free Password Generator, Entropy Calculator, and Breach Checker.