SHA-256 remains standardized and has no practical quantum break. Generic quantum query models reduce its preimage and collision margins, so suitability still depends on the construction and assurance profile.
Key Takeaway: SHA-256 is considered quantum safe. Approved for post-quantum use. No deprecation planned.
SHA-256 IS quantum safe.
SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function from the SHA-2 family, designed by the NSA and standardized by NIST in FIPS 180-4 (2001). Hash functions take an arbitrary-length input and produce a fixed-size output (256 bits for SHA-256) called a digest or hash. SHA-256 is deterministic (same input always produces same output), one-way (computationally infeasible to reverse), and collision-resistant (extremely difficult to find two inputs producing the same hash).
The algorithm processes input data in 512-bit blocks through 64 rounds of bitwise operations (rotations, shifts, XOR, AND, OR) and modular additions. It uses eight 32-bit working variables initialized with specific constants derived from the square roots of prime numbers. The final hash is the concatenation of these variables after processing all input blocks.
SHA-256 is critical infrastructure: Bitcoin and other proof-of-work blockchains use SHA-256 for mining and transaction IDs, TLS/SSL certificate chains use SHA-256 for certificate fingerprints and signature hashing (RSA-SHA256, ECDSA-SHA256), password storage systems use SHA-256 as input to key derivation functions (PBKDF2, scrypt, Argon2), and integrity verification for software downloads, git commits, and file systems rely on SHA-256 checksums.
Hash functions face two primary quantum threats: preimage attacks (finding an input that produces a given hash) and collision attacks (finding two inputs with the same hash). Grover's algorithm accelerates both attacks but does not break SHA-256.
For preimage resistance, the idealized query complexity falls from roughly 2256 classically to roughly 2128 with Grover search. Real cost depends on reversible hash circuits, error correction, parallelization, and verification; this page does not convert that model into a calendar forecast.
Generic quantum collision algorithms change the asymptotic query model relative to the classical birthday bound. Their concrete time, memory, circuit, and error-correction costs matter; the result is not evidence of a practical SHA-256 collision attack.
SHA-256 remains standardized, but suitability depends on the construction and assurance profile. Avoid attributing a single memory requirement to every quantum collision algorithm.
No migration is required for SHA-256 itself — it remains approved for post-quantum cryptographic use. However, organizations must be careful about how SHA-256 is used:
Organizations should audit cryptographic implementations to distinguish between SHA-256 usage (quantum-safe) and signature algorithm vulnerability (quantum-vulnerable).
While SHA-256 itself is quantum-safe, its association with vulnerable signature schemes creates indirect risk:
Cryptocurrency networks like Bitcoin use SHA-256 extensively for mining (proof-of-work), transaction IDs, and Merkle tree construction. These hash-based components are quantum-resistant. However, Bitcoin's ECDSA signatures are vulnerable, creating a common misconception that "Bitcoin isn't quantum-safe." The hash function is safe; the signature layer requires upgrading.
Software supply chains rely on SHA-256 for file integrity verification (checksums, hash trees) and git commit IDs. These hash uses are quantum-safe. However, code signing certificates (RSA-SHA256, ECDSA-SHA256) require PQC migration because the signature algorithm is vulnerable, not the hash.
Certificate ecosystems use SHA-256 in several distinct roles. Signature transition depends on the certificate profile, relying-party support, and applicable policy; NIST IR 8547's draft horizons are not a universal CA deadline.
Organizations should maintain SHA-256 for hashing but immediately plan PQC migration for any signature algorithms (RSA-SHA256, ECDSA-SHA256) to ML-DSA or SLH-DSA.
| Full Name | Secure Hash Algorithm 256-bit |
| Category | hash |
| Quantum Vulnerability | Generic quantum preimage search has idealized query complexity on the order of 2^128; collision algorithms have different time-memory tradeoffs. |
| NIST Status | Approved for post-quantum use. No deprecation planned. |
| Deprecation Timeline | No deprecation planned. |
| Replaced By | No replacement needed — SHA-256 is quantum resistant |
Algorithm-level classification. Standards status and known cryptanalysis are separated from implementation, module-validation, protocol-composition, key-management, and policy evidence.
Evidence-scope review: 2026-07-10
No migration needed for SHA-256 when used as a hash function. Ensure it is not used as part of a vulnerable signature scheme (e.g., RSA-SHA256 — the RSA part is vulnerable).
SHA-256 is quantum safe, but your cryptographic posture is only as strong as its weakest link. QScout maps cryptographic inventory within approved scope under a governed engagement.