SHA256 Hash Length: Why It Is Always 64 Characters

The numbers

SHA-256 outputs 256 bits. That is 32 raw bytes, or 64 characters when printed as lowercase hexadecimal — the format nearly every tool shows. Encoded as standard Base64 it is 44 characters including one padding "=", and 43 without padding.

The name says it: the 256 in SHA-256 is the digest length in bits, not a version number. Same for SHA-512 (128 hex characters) and SHA-1 (40).

Why input size does not change it

SHA-256 pads the message to a multiple of 512 bits and processes it block by block, folding each block into a fixed 256-bit internal state. When the last block is done, that state is the digest. There is nowhere for extra length to go.

A consequence worth remembering: digest length tells you nothing about the original. You cannot infer whether the input was a password or a video file.

Sizing your database column

Storing hex is exact at CHAR(64) and lets the database skip length bookkeeping. Storing raw bytes halves the storage and indexes faster, at the cost of being unreadable in a query result:

-- hex: readable, 64 characters
hash CHAR(64) NOT NULL

-- raw bytes: half the size, faster to index
hash BINARY(32)   -- MySQL
hash BYTEA        -- PostgreSQL

With the hex column, add a check constraint or use a binary collation so comparisons are not affected by case or trailing spaces. For high-volume tables the binary form is usually the better trade.

Do not use VARCHAR(255) out of habit — it invites truncated or padded values that silently never match.

Identifying a hash by its length

A 32-character hex string is MD5. 40 is SHA-1. 64 is SHA-256. 128 is SHA-512. This is a fast sanity check when a checksum file does not label its algorithm.

Watch out for strings that look like hashes but are not: bcrypt hashes are 60 characters and start with $2y$, and a 64-character string containing letters past f is not hexadecimal at all.