When hashing a messages of size of n, does the SHA2 algorithm always produce the same sized hashed value?

The reason I am asking is that I am building an OAuth 2.0 authorisation server and I want to publish the size of the client identifier as recommended in the RFC.

up vote 1 down vote accepted

The idea of a cryptographic hash function is that it maps an input of arbitrary length to an output of fixed length.

Some information about hash functions that will be useful to know:

SHA-1 will for example map any input to a seemingly random 160 bit hex string. Consequently such a function can never be injective, that is map an input to a unique output such that the output still can be used to identify the input. In theory there are an infinite amount of inputs thay produce the same output. In practice such a colission is very hard to find in a well designed hash algorithm. SHA-1 is an algorithm that had been SHAttered.io. There is a collision found but it cost a tremendous amount of computing power.

You said you will be using SHA-512 or some other more modern hash function. They also have an infinite amount of colissions but the amount of effort needed to find one is enormous by todays standard, but that will also change in the future when computing power will increase.

Yes, the size of hash is fixed. I.e. sha256 produces 256 bits, sha512 - 512 bits, it doesn't depend on input size. The same applies to other cryptographic hash functions.

The obvious answer from the Wikipedia;

SHA-2 includes significant changes from its predecessor, SHA-1. The SHA-2 family consists of six hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256.

Select the appropriate one.

  • 1
    Or pick SHA-512 and truncate for lengths between 1 and 512 bits. – Future Security Nov 9 at 21:47

When hashing a messages of size of n, does the SHA2 algorithm always produce the same sized hashed value?

SHA-2 output is always fixed.

SHA-512 will always produce a message digest of 512 bits – hence its name – and is practically represented using 64 binary bytes, or 128 chars when HEX-encoding the message digest.

It does not matter how long or short your input is. As an extreme case: one can even produce an SHA-512 output with a zero-length input (aka “no input”) and, as you can see, its output (aka message digest) is exactly 512 bits…


For more details on how the final output of SHA-512 is calculated, see the explanation in RFC4634, on page 14 (quote):

For SHA-512, this is the concatenation of all of H(N)0, H(N)1, through H(N)7.

Since – as the RFC explains – those eight $H(N)_0 \dots H(N)_7$ are each 64 bit values, this concatenation results in a 512 bit (message digest) output value.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.