SHA-256

Bitcoin leans on that one function almost everywhere: block hashes, transaction ids, merkle trees, address checksums, and the checksum in your seed phrase. The output is 256 bits, printed as 64 hexadecimal characters, drawn from a space of roughly 1.2 times 10 to the 77th values. That is the arithmetic that catches a mistyped address before your coins go anywhere.

How it works

SHA-256 chops its input into 512 bit chunks and stirs each one through 64 rounds of shifts, rotations, and additions.

The state being stirred is eight 32 bit words, seeded with constants taken from the fractional parts of the square roots of the first eight prime numbers, while the 64 round constants come from the cube roots of the first 64 primes. Those origins are the point: they are numbers nobody could have chosen for a hidden reason, which is how the design argues it has no back door. The algorithm was produced by the United States National Security Agency and published by NIST in 2001, and the current specification is FIPS 180-4.

Three properties are what bitcoin actually buys. The function is deterministic, so any machine anywhere derives the same digest from the same bytes. It avalanches, so flipping one bit of input changes about half the output bits, with no pattern connecting the two. And it resists being run in reverse: nobody has found a way to recover an input from a digest, or to produce two inputs sharing one, faster than brute force. SHA-1 fell to a practical collision in February 2017, which cost the researchers an enormous amount of computation and did not carry over to SHA-2 at all.

Bitcoin rarely calls it once. Block headers, transaction ids, merkle nodes, and the checksum on a peer to peer message all use a double pass, hashing the digest a second time. Address hashes take a different route, RIPEMD-160 applied to a SHA-256 digest, which is where the 20 byte payload of a legacy address comes from. Taproot broke the pattern again: BIP340 defines tagged hashes that call SHA-256 once, with a domain separating prefix, so signatures for one purpose cannot be replayed for another.

Where you see it

Every 64 character hex string in a block explorer is a SHA-256 output. That includes the transaction id you paste into support tickets and the block hash beginning with a long run of zeroes, which is what a header that beat the target looks like.

Two places matter directly when you hold coins. A seed phrase carries a checksum built from this function: 12 words encode 128 bits of randomness plus 4 checksum bits taken from the SHA-256 digest of that randomness, so a phrase with one word wrong is rejected about 15 times out of 16 rather than silently opening an empty wallet. A legacy address carries a similar guard, a 4 byte checksum from a double SHA-256 pass, which makes the odds of a random typo producing a valid address roughly 1 in 4.3 billion.

Mining hardware exists for nothing else. An ASIC is a chip that computes this one function and no other, which is why bitcoin miners cannot be repurposed for chains built on a different algorithm, and why the phrase SHA-256 coin describes an entire family of forks. Note the limit of all this: a checksum catches an address you typed wrong, never an address that malware swapped for one that is perfectly valid and not yours.