Yes. SHA-256 is designed to be a one-way hash: computing a digest from a message is practical, but finding a message that matches a chosen digest is intended to be computationally infeasible. “One-way” is a security property, not proof that reversing the function is mathematically impossible.
What “one-way” means for SHA-256
A cryptographic hash takes a bit string of any length and produces a fixed-length digest. For SHA-256, that digest is 256 bits. NIST defines one-wayness in terms of preimage resistance: given a specified output, it should be computationally infeasible to find an input that produces it. The NIST glossary definition of one-wayness describes that property as a computational limit, not a guarantee of mathematical impossibility.
As an Amazon Associate I earn from qualifying purchases.
In ordinary use, calculating the digest from a message is straightforward. The intended protection is that someone who sees only a digest cannot feasibly work backward to recover a matching message. A matching message need not be the original one; the question is whether any input can be found that produces the specified digest.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Preimage resistance is not collision resistance
Because SHA-256 maps inputs of arbitrary length to only 256 bits, different inputs can produce the same digest. That fact does not by itself make the hash reversible or show that an attacker can find such inputs efficiently. The attack goals are distinct:
#1 Best Overall
| Property | What an attacker is trying to find | NIST expected strength for SHA-256 |
|---|---|---|
| Preimage resistance | An input matching a particular, already specified digest | 256 bits |
| Collision resistance | Any two distinct inputs with the same digest | 128 bits |
| Second-preimage resistance | A different input matching the digest of a particular given message | 256 − L(M) bits, where L(M) reflects the message length in 512-bit blocks |
These are NIST’s expected security strengths, not measurements of every implementation or a promise that every application using SHA-256 is secure. The NIST Hash Functions page lists the figures and distinguishes the three properties. In particular, the 256-bit digest size does not mean every category of attack has 256-bit strength.
Can SHA-256 be reversed?
There is no practical general-purpose “undo” operation that recovers an arbitrary original message from its SHA-256 digest. Finding a preimage for a target digest is intended to be computationally infeasible. But this does not mean every attempt to identify an input must fail: if the possible inputs come from a small or predictable set, someone can calculate their digests and compare them with the target. Hashing does not conceal a weak, guessable input by making it hard to enumerate.
For example, a digest can be checked against candidate messages by hashing each candidate and comparing the result. This is testing guesses, not reversing SHA-256. The distinction matters whenever the input may be drawn from a limited set.
What SHA-256 does—and does not—establish
NIST’s Secure Hash Standard specifies SHA-256 as an iterative, one-way hash function that produces a message digest. A digest can help detect a message change: NIST says a change will, with very high probability, result in a different digest. See FIPS 180-4, Secure Hash Standard.
A matching digest can therefore support an integrity check when compared with a trusted digest. By itself, however, a hash does not prove who created a message, authenticate its source, or make an application secure. Those outcomes depend on how the digest is obtained and used, and on the surrounding system.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.SHA-256’s standards context
SHA-256 belongs to the SHA-2 family. NIST’s FIPS 202 specifies SHA-3 and describes it as supplementing SHA-1 and SHA-2, including SHA-256; that does not make SHA-3 an automatic replacement or establish one universal choice for every application. Selection depends on the application’s requirements and applicable implementation considerations. See FIPS 202, SHA-3 Standard.
The FIPS 180-4 publication page identifies the standard as published in August 2015 and includes a planning note dated March 7, 2023, stating that NIST decided to revise it after two rounds of public comment. For the current publication status, consult the live NIST FIPS 180-4 page.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
