SHA-256 vs SHA-512 on exactly the same input
Enter MultiVerto, with that capitalization and no leading or trailing space, in the embedded SHA-256 tool. Its hexadecimal digest begins ae71dfc48b890921 and ends c68938f7185915aa. Open the linked SHA-512 tool and enter the identical ten-character text. That digest begins cacbdf4e6ceeaa77 and ends b71e458c3b7209d9. These are different algorithms, not two display lengths of one result. If your values differ, check the exact input bytes: a newline copied at the end, a space, changed capitalization, or a different character encoding changes the digest. The site encodes the entered text as UTF-8 before the browser computes either hash. For a reproducible check, record the algorithm name, the precise input and whether a final newline belongs to it. A digest cannot be decoded to recover the original text.
Why the output lengths are 64 and 128 hex characters
FIPS 180-4 defines SHA-256 with a 256-bit output and SHA-512 with a 512-bit output. One hexadecimal character represents four bits, so the normal text form uses 64 characters for SHA-256 and 128 for SHA-512. The larger result is twice as long to store or transmit in hex. It does not mean that SHA-512 is simply SHA-256 with characters appended; the internal computation differs. Check the format expected by the system receiving the digest. If its manifest, API or database field requires SHA-256, a SHA-512 value will not match even when both parties hash the same bytes correctly. Also distinguish a raw digest from formats that add an algorithm prefix, salt or signature. Those extra parts must be interpreted according to their own specification.
- Exact text: MultiVerto, no newline
- UTF-8 bytes in the browser
- SHA-256 → 64 hexadecimal characters
- SHA-512 → 128 hexadecimal characters
Use a trusted digest for an integrity check
Suppose a publisher supplies a trusted SHA-256 digest for a download. Hash the downloaded bytes with SHA-256 and compare the complete 64-character value, not just the first few characters shown in our example. A match strongly indicates that the compared bytes are the same as those represented by the supplied digest. The same process works with SHA-512 only when the publisher supplies a SHA-512 reference. MultiVerto hashes text entered into its field, so a file checksum requires a tool that hashes the exact file bytes; pasting a filename or a textual rendering is not equivalent. Obtain the expected digest through a trustworthy channel. If an attacker can replace both the file and the displayed reference hash, an unkeyed hash comparison alone does not authenticate the publisher. Digital signatures or authenticated channels address that separate question.
Choose by security needs and compatibility
Both algorithms are standardized SHA-2 functions. A collision means two different inputs have the same digest, whereas a mismatch between your computed value and a reference usually means the bytes or algorithm differ. A larger output gives SHA-512 a larger theoretical collision-resistance margin, but output length is not the only design consideration. Interoperability with the protocol, expected digest format, performance in the actual environment and applicable requirements matter too. Do not switch an established SHA-256 checksum format to SHA-512 merely because 128 hex characters look more secure. Conversely, when designing a new workflow and its specification allows either, document the chosen algorithm and test it on actual data. Never compare a SHA-256 digest directly with a SHA-512 digest and conclude that one input changed; their outputs are necessarily different.
Neither plain hash is a password-storage scheme
A raw SHA-256 or SHA-512 digest is fast to compute. That is useful for checksums, but it lets an attacker who steals a password database try guesses quickly. OWASP recommends purpose-built, salted, adaptive password hashing such as Argon2id, with alternatives chosen for the deployment context. Merely choosing SHA-512 or hashing a password twice does not turn a raw digest into an appropriate password verifier. A hash is also not encryption: there is no decryption key and it does not hide predictable input from guessing. MultiVerto performs these text hash calculations locally in your browser rather than uploading the entered text for conversion. Even so, do not paste secret production passwords into a demonstration workflow; use the application’s approved password-handling system. Save the chosen algorithm alongside any checksum so a future comparison is meaningful.