NIST didn't invent SHA-256 in a vacuum — it, and the rest of the SHA-2 family, were published in 2001-2002 as a direct response to early theoretical cracks appearing in SHA-1. When actual collisions in SHA-1 were demonstrated by researchers in 2017 (the "SHAttered" attack, which produced two different PDFs with the same SHA-1 hash), the industry had already spent over a decade migrating critical systems to SHA-2, which is why the damage was largely contained.
What all hash functions have in common
The key property is determinism: the same input always produces the same hash. The second property is the avalanche effect: changing a single bit in the input completely changes the output, so you can't tell from a hash how similar two source files are.
Why MD5 and SHA-1 are considered insecure
Practical ways have been found to create two different sets of data with the same hash for both algorithms — a so-called collision. This makes them unsuitable wherever cryptographic strength matters (digital signatures, certificates), though they're still used where only a quick integrity check is needed, not protection against an attacker.
SHA-256 and the SHA-2 family
SHA-256 generates a 256-bit hash and currently has no known practical collisions. It's used in blockchains, TLS certificates, and software integrity verification, where resistance to deliberate tampering matters.
Why you'd need this
- Verifying downloaded files by comparing against a published hash.
- Creating short, unique fingerprints for large amounts of data.
- Understanding why a particular algorithm is or isn't suitable for a given security task.
Why SHA-3 didn't replace SHA-2
SHA-3 was chosen as the winner of a separate NIST competition to serve as insurance in case a fundamental vulnerability were ever found in SHA-2 — it's a hedge built on a fundamentally different internal construction (Keccak), not a successor in the sense of a replacement. Since no practical attacks on SHA-2 have been found, SHA-256 and SHA-512 remain the default standard in most systems, while SHA-3 gets used selectively where architectural diversity specifically matters.