Hash function

A hash function turns any amount of data into a short, fixed-size fingerprint called a hash. Bitcoin uses SHA-256 most of the time. It also builds two combinations on top of it: HASH256, which applies SHA-256 twice, and HASH160, which follows SHA-256 with RIPEMD-160. Hashes link blocks and transactions together, and they drive mining, where a block hash must fall below a target.

What is a hash function?

A hash function takes an input of any length and returns an output of a set size. SHA-256 always returns 32 bytes (256 bits), whether the input is one byte or a whole block of data. The output looks random, so you can use it as a reference number for the input.

The bytes of a hash are usually shown as hexadecimal characters. Each byte becomes two hex digits, so a 32-byte SHA-256 output has 64 characters.

What makes a hash function strong?

A simple fingerprinting function needs two properties. It must give the same output for the same input, which is called being deterministic. It must also return a fixed size. A strong (cryptographic) hash function needs three more properties:

Property	What it means
Preimage resistance	Given a hash, you cannot find an input that produces it.
Second preimage resistance	Given one input, you cannot find a different input with the same hash.
Collision resistance	You cannot find any two inputs that share a hash.

Strong hash functions also show the avalanche effect. A tiny change to the input changes about half of the output bits.

What happens when one input bit changes?

The grid above shows the avalanche effect. The byte 00 and the byte 01 differ by one bit, but their SHA-256 hashes share no visible pattern. About half of the bits change, which is what a good hash should do. Because the output is unpredictable, nobody can choose an input to get a result they want. Bitcoin relies on that property in mining.

Which hash functions does Bitcoin use?

Bitcoin uses a handful of hashing methods. Most of them are built from SHA-256.

Method	Built from	Output	Main use in Bitcoin
SHA-256	One round of SHA-256	32 bytes	Script hashes in P2WSH, and inside tagged hashes
HASH256	SHA-256 applied twice	32 bytes	Block hashes, TXIDs, merkle roots, checksums, signature hashes
HASH160	SHA-256, then RIPEMD-160	20 bytes	Public key hashes (P2PKH, P2WPKH) and script hashes (P2SH)
Tagged hash	SHA-256 with a tag prefix	32 bytes	Schnorr signatures and Taproot
HMAC-SHA512	SHA-512 with a secret key	64 bytes	Child keys in HD wallets
PBKDF2	HMAC-SHA512, run 2,048 times	64 bytes	The seed made from a mnemonic phrase

The FIPS 180-4 standard defines SHA-256. RIPEMD-160 is defined in a 1996 paper by researchers at KU Leuven.

How is HASH256 calculated?

HASH256 is the most common method. You hash the data once with SHA-256, then hash that 32-byte result with SHA-256 again.

import hashlib

def hash256(data: bytes) -> bytes:
    return hashlib.sha256(hashlib.sha256(data).digest()).digest()

print(hash256(bytes.fromhex("aa")).hex())
# e51600d48d2f72eb428e78733e01fbd6081b349528335bf21269362edfae185d

Block hashes and TXIDs shown by bitcoin-cli appear in reverse byte order. The raw bytes are the same, only the display differs. The byte order page explains the reversal.

How is HASH160 calculated?

HASH160 hashes the data with SHA-256 and then with RIPEMD-160. The second step shortens the result from 32 bytes to 20 bytes, which keeps addresses short.

import hashlib

def hash160(data: bytes) -> bytes:
    return hashlib.new("ripemd160", hashlib.sha256(data).digest()).digest()

print(hash160(bytes.fromhex("aa")).hex())
# 58d179ca6112752d00dc9b89ea4f55a585195e26

A public key is 33 or 65 bytes long. Hashing it with HASH160 gives the 20-byte public key hash that most addresses carry. P2SH script hashes also use HASH160.

What is a tagged hash?

A tagged hash adds a name, the tag, in front of the data. Schnorr signatures and Taproot define their hashes this way, so a hash made for one purpose cannot be mistaken for a hash made for another. BIP 340 defines the scheme as:

tagged_hash(tag, msg) = SHA256(SHA256(tag) || SHA256(tag) || msg)

Repeating the tag hash is a speed trick. The prefix is 64 bytes, which fills exactly one SHA-256 block, so an implementation can compute that block once and reuse it.

import hashlib

def tagged_hash(tag: str, msg: bytes) -> bytes:
    t = hashlib.sha256(tag.encode()).digest()
    return hashlib.sha256(t + t + msg).digest()

print(tagged_hash("BIP0340/challenge", b"").hex())
# c216d352f5818b7b4beacd4ae0a26fe888080823d2a598856661bcd54f1b3713

Taproot uses the same construction with its own tags, such as TapSighash, defined in BIP 341.

Why does the input type matter?

A common mistake is to hash the hex text rather than the bytes it stands for. The text ab is two ASCII characters, 0x61 and 0x62. The byte 0xab is a single value. Hashing them gives different results.

import hashlib

print(hashlib.sha256(b"ab").hexdigest())                 # the text "ab"
# fb8e20fc2e4c3f248c60c39bd652f3c1347298bb977b8b4d5903b85055620603
print(hashlib.sha256(bytes.fromhex("ab")).hexdigest())   # the byte 0xab
# 087d80f7f182dd44f184aa86ca34488853ebcc04f0c60d5294919a466b463831

Always convert hex to bytes before you hash it. If your hash does not match a known result, check this first.

Where does Bitcoin use hashing?

Hashing appears in almost every part of Bitcoin:

• Block hash: HASH256 of the 80-byte block header. Mining searches for a header whose hash is below the target.
• Merkle root: hashes the TXIDs in pairs, up to one root for the whole block.
• TXID: HASH256 of a transaction, used as its reference number.
• Checksum: the first 4 bytes of HASH256, added to Base58 addresses to catch typing errors.
• Signature hash: the message that each signature covers.
• Extended keys: HMAC-SHA512 creates each child key from its parent.
• Mnemonic seed: PBKDF2 turns the words and optional passphrase into a 64-byte seed.

Why is HASH256 applied twice?

Satoshi Nakamoto never explained the double hash. One likely reason is the length extension attack, which can matter when a hash covers secret data. Most of Bitcoin's hashes cover public data, where that attack does not matter, so the extra round is now mostly a quirk. Later designs have dropped it where they could. P2WSH, defined in BIP 141, uses a single SHA-256 for its script hash. The double hash is a quirk of Bitcoin that you need to know, not a rule to copy.

What comes next?

A hash turns data into a fingerprint, but it cannot prove who made the data. For that, Bitcoin uses a curve. Continue with elliptic curve maths, then the ECDSA and Schnorr signature pages.