DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowOctober DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run Scan×
Skip to content
World desk6 min

Git 3.0 Migration: Should You Move to SHA-256 and Reftable?

Git 3.0 has no planned release date. Its proposed SHA-256 and reftable defaults apply to new repositories; existing repositories need a careful compatibility review before migration.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

You do not need to convert an existing Git repository just because Git 3.0 is proposed. The Git project’s proposal would make SHA-256 the default object format and reftable the default reference backend for newly initialized repositories. As of the proposal dated October 7, 2026, Git 3.0 has no planned release date, and those defaults depend on ecosystem readiness. Treat migration as a separate compatibility and operations decision—not as a requirement that comes with the release.

What Git 3.0 is proposing—and what it is not

The proposed change affects defaults for repositories created under Git 3.0:

As an Amazon Associate I earn from qualifying purchases.

  • Object format: SHA-256 instead of SHA-1.
  • Reference storage: reftable instead of the files backend.

These are separate choices. SHA-256 changes how repository objects are identified; reftable changes how references and their logs are stored. A repository can use SHA-256 without reftable, or reftable without changing its object format. The proposal does not say existing SHA-1 repositories must be converted, and it does not plan to deprecate SHA-1 at this time.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The Git project says there is no planned release date for Git 3.0. Its proposal makes ecosystem readiness a prerequisite, including support in libraries, applications, forges and alternative Git implementations. The defaults are therefore proposals, not a release schedule or a promise that every tool already supports both formats.

What changes when a repository uses SHA-256?

Git uses object identifiers to refer to blobs, trees, commits and tags. SHA-1 object names are 40 hexadecimal characters; SHA-256 names are 64. In a SHA-256 repository, commits, trees and tags that refer to other objects have different contents because those references change. Blobs do not refer to other objects.

Git’s hash-transition design describes a bidirectional mapping between SHA-1 and SHA-256 object names stored alongside object data. In that design, fetching from a SHA-1 server converts fetched objects into SHA-256 form and records the mapping; pushing to a SHA-1 server converts objects back to SHA-1 form. The mapping is generated locally and can be checked with git fsck. This is a compatibility mechanism, not a claim that one repository contains a mixture of SHA-1 and SHA-256 objects: intermixing the two formats in one repository is not a goal of the design.

Compatibility is the main cost

Older Git versions cannot read SHA-256 repositories. Before adopting the format, identify the oldest Git client and every embedded Git implementation used by developers, CI, IDEs, hooks, build tools, hosting services and automation. A recent command-line Git on one machine is not enough if another part of the workflow cannot understand the repository.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The transition design also identifies protocol-related limitations. In particular, support for SHA-256 in the Git protocol is outside the initial design; shallow clones or fetches into SHA-256 repositories and some submodule-fetch behavior depend on that support. Check the behavior of the exact Git release and server you intend to use rather than assuming that the mapping makes every workflow compatible.

What reftable changes

References are names such as branches and tags that point to objects. The existing files backend stores references using filesystem paths; reftable stores references and logs in a portable binary table format. The reftable specification supports both SHA-1 and SHA-256 identifiers, so adopting it does not by itself change the repository’s object format.

The Git project’s stated reasons for proposing reftable as the default include:

  • Reducing ref-name conflicts caused by filesystem case folding and Unicode normalization.
  • Avoiding a full packed-refs rewrite when references are deleted.
  • Supporting geometric compaction, atomic multi-reference transactions and more efficient writes of many references.
  • Reducing storage through prefix compression.

These are format and design benefits, not guaranteed performance results for every repository. Their value depends on the repository’s size, ref count, workload and tooling. Examples or benchmarks in the format documentation should not be treated as universal promises.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Which choices fit your repository?

Decision What to weigh Practical implication
Keep SHA-1 or use SHA-256 Old-client compatibility, forge support, protocol-dependent workflows and embedded libraries. Choose according to the least capable consumer in the workflow, not just the Git CLI on your workstation.
Keep files or use reftable Worktree status, concurrent writers, implementation support, ref count and filesystem naming constraints. Reftable may help with filesystem edge cases and large-ref-set costs, but migration has operational restrictions.
Migrate now or defer Readiness of hosting and tooling, plus your ability to stage and roll back. Git 3.0 has no planned date in the proposal, and existing SHA-1 repositories are not described as requiring conversion.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

How to plan a repository migration safely

Plan the two format changes independently. The documented migration command covers reference storage; it is not an object-format conversion command. The materials described here do not establish a general SHA-1-to-SHA-256 conversion procedure or a single command that safely converts every repository and workflow. Confirm the supported path for your Git build and integrations before attempting an object-format change.

  1. Inventory the repository and consumers. Record git --version, the repository’s object and ref-storage formats, registered worktrees, remotes, and every tool or service that reads or writes it. Check the installed Git documentation for how to inspect the formats; do not infer them from a successful command on one client.
  2. Check compatibility end to end. Confirm support for the intended format in developer clients, servers and forges, libraries, CI, IDEs, hooks, submodules and repository-management tools. Ask vendors about the exact versions and workflows you use, then test representative clones and pushes in a staging repository. The Git project’s proposal makes ecosystem readiness a prerequisite; no provider-by-provider support matrix is established here.
  3. Back up and validate before changing ref storage. Make a recoverable backup and check that it can be restored. Pause repository writes and scheduled maintenance. The migration command cannot prevent concurrent writers, and concurrent changes may leave the migrated state inconsistent. Repositories registered for scheduled maintenance should be unregistered first.
  4. Migrate one dimension at a time. For ref storage, Git 2.46 release notes introduced migration from files to reftable. Current command documentation gives this synopsis: git refs migrate --ref-storage-format=<format> [--no-reflog] [--dry-run]. Confirm the exact option spelling and availability in the installed Git version before running it; documentation and release-note wording have differed. For a reftable dry run, use the installed version’s documented syntax with --dry-run, then perform the migration only after reviewing the result and blocking writes. Do not treat this command as a SHA-256 migration.
  5. Verify the result and dependent workflows. Use git refs verify to check reference database consistency. For SHA-256 mapping and object consistency, Git documents git fsck. Also verify refs, reachability, remotes, CI, hooks, submodules and developer tooling in the actual workflow.
  6. Keep a rollback route. Retain the validated backup and a way to restore or resume the previous workflow until all repository consumers have been confirmed to work.

Reftable migration limits to account for

  • Repositories with worktrees cannot be migrated using the documented command.
  • The command cannot lock out concurrent writes; stop writers externally before migration.
  • Scheduled maintenance can write to the repository, so unregister the repository from scheduled maintenance before the operation.

What is known about tool support?

Git 2.45 release notes describe work to support repositories that work with both SHA-1 and SHA-256. Git 2.46 release notes add reference-storage migration and note CI interoperability testing for reftable written by JGit. Those milestones do not establish current support across every forge, library, IDE or automation tool, and the Git 3.0 proposal still treats ecosystem readiness as a prerequisite.

A libgit2 maintainer said in an October 4, 2024 discussion that SHA-256 support could be enabled with EXPERIMENTAL_SHA256, describing it as somewhat well tested but not battle-tested in a Git forge. That is historical, implementation-specific information—not a statement of current libgit2 status. Check the version and configuration you actually depend on.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.