SHA-256 vs SHA-512: Which Hash Should You Use?
Both are SHA-2. What actually differs is output length, speed on 64-bit CPUs, and what the surrounding system expects.
2026-10-20 · Security
What they share
Both are SHA-2 family functions, both are collision-resistant in practice, and both are fine for integrity checks and reset tokens.
Output size
SHA-256 gives 32 bytes (64 hex characters); SHA-512 gives 64 bytes (128 hex characters). A 64-character database column fits SHA-256 exactly.
Speed
On 64-bit processors SHA-512 is often faster per byte because its word size matches the CPU. On small 32-bit devices the advantage reverses.
What not to use
MD5 and SHA-1 are broken for security. For passwords use bcrypt, scrypt or Argon2 — never a raw hash.
Is SHA-256 good for passwords?
No — it is far too fast. Use bcrypt, scrypt or Argon2.
Can I truncate a hash?
You can, but it weakens the guarantee.