Take the 2-minute tour ×

When hashing a string, like a password, with sha256, is there a limit to the length of the string I am hashing? For example, is it only "safe" to hash strings that are <= 64 characters?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

There is technically a limit, but it's quite large. The padding scheme used for SHA-256 requires that the size of the input (in bits) be expressed as a 64-bit number. Therefore, the maximum size is (264-1)/8 bytes ~= 2091752 terabytes.

Edit: I'd intended to add (but forgot to) that this limitation is almost entirely theoretical, not practical.

Even assuming you had that much data to work with (unlikely, to say the least) the time to hash that much data would generally be prohibitive anyway. Of course, if you had an essentially unlimited budget so you could afford hundreds, just doing the processing on that amount of data (even assuming specialized, dedicated hardware) it'd still take longer than most people would ever consider waiting (probably years, not hours, days or even weeks).

share|improve this answer

There is no such limit, other than the maximum message size of 264-1 bits. SHA2 is frequently used to generate hashes for executables, which tend to be much larger than a few dozen bytes.

share|improve this answer
I try to understand your answer: Do you mean 2^{64}-1 bits or do you mean 65 bits length? 2^64 is quite a lot bits. –  Stefan Jan 14 at 10:53
The former, @Stefan. Yep, that's a lot of bits. :-) –  Michael Petrotta Jan 14 at 14:52
haha - ok yeah I don't need that much bits but that's good to know. Thank you! –  Stefan Jan 14 at 16:14

Your Answer


