# Is there a way to tell if a given string is a sha256 hash?

Just like, for instance, we can easily check if a given number is a visa card number, by verifying prefix and checksum - can we do anything similar for hash?

Hashes have no defined structure as e.g. IBAN bank account numbers, to follow your example (not sure about the case for credit cards).

The output of SHA is essentially a number value, without checksums or other additional elements.

To answer your question, the only check you can perform is to verify that the potential SHA-256 hash is 256-bits long. In fact, since you can feed arbitrary inputs into the algorithm, any 256-bit value will be a correct SHA-256 hash for some input(s).

Since you mention strings as the datatype to check: note that the “string” hash is commonly a minimal hexadecimal representation of said hash. The minimal form of hexadecimals consists of two digits per byte, where each digit is a character ranging from 0 to 9, a to f or A to F.

So if your candidate string contains any other letters/symbols it can be rejected. This is a trivial check that lets you distinguish between (2 * 32 = 64) hexadecimals and other text - it doesn't proof that the bytes are the output of a hash function.

• Technically we can't prove that SHA-256 is surjective, though it likely is (and it doesn't really matter in practice). – CodesInChaos Dec 25 '17 at 20:56
• The output of the SHA families of hashes is defined as bits, usually grouped together as bytes, as bitarrays are usually not present or effective on runtimes of computers. So "The output of SHA is essentially a number value" is not technically correct. – Maarten Bodewes Apr 21 '19 at 9:35