SHA-256: A cryptographic hash function from the SHA-2 family that maps any input to a fixed 256-bit output, designed so the output cannot be reversed and different inputs practically never produce the same result.
Also known as: Secure Hash Algorithm 256-bit, SHA-2 (family)
Key takeaways
- Hashing is one-way: you can compute a hash from data, but not data from a hash.
- Hashing is not encryption; there is no key and nothing to decrypt.
- The same input always produces the same hash, which makes hashes useful for comparing values without revealing them.
- Short or predictable inputs, like phone numbers, can be guessed by hashing candidates, so storage practices matter.
- C Chat hashes phone numbers with SHA-256 on the device for contact matching, and the server does not store the hashes.
Hashing is one of the quiet workhorses of security. It sits behind software downloads, website certificates and the “find friends” feature of messaging apps. SHA-256 is the most widely used hash function today, and understanding it helps you judge privacy claims about contact discovery.
SHA-256 hashing: a plain definition
A hash function takes input of any size and produces an output of fixed size, called a hash or digest. SHA-256 belongs to the SHA-2 family published by the US National Institute of Standards and Technology, and its output is always 256 bits.
Good cryptographic hashes have three properties:
| Property | Meaning |
|---|---|
| Deterministic | The same input always gives the same hash |
| One-way | You cannot work backwards from the hash to the input |
| Collision-resistant | It is practically impossible to find two inputs with the same hash |
Change one character of the input and the hash changes completely, which is why hashes work as fingerprints.
How it works
SHA-256 splits the input into blocks and runs each one through 64 rounds of bitwise operations, mixing the result into an internal state. After the last block, that state becomes the 256-bit hash.
There is no key involved. That is the key difference from encryption such as AES, which needs a secret to scramble and unscramble data, and from public-key cryptography, which uses key pairs. Hashing is also unrelated to the long-lived secrets covered by key management or the separation provided by per-organization keys.
Why it matters for business messaging
The most common use of hashing in messaging is contact discovery: finding which of your phone contacts already use the app. The naive approach is to upload the whole address book in readable form, which exposes the numbers of people who never signed up.
Hashing improves this. The device hashes each number and the service compares hashes instead of raw numbers. It is not a complete answer, though. Phone numbers are short and follow known formats, so someone holding a list of hashes could hash every possible number and look for matches. The real protection comes from combining hashing with not keeping the hashes after matching.
How it relates to C Chat
C Chat’s private phone contact matching hashes phone numbers with SHA-256 on your device. The server uses them to find matches and does not store the hashes. The details are in how contact matching protects phone numbers.
You do not have to use contacts at all. C Chat lets you reach any user by @username, without exchanging phone numbers, and you can start direct messages with any C Chat user, by username, phone contact or team membership, with no message requests. Block and report are available if someone contacts you unwanted.
Message content is protected differently: TLS in transit and AES-256 at rest with per-organization keys. Hashing is only used where comparison without disclosure is the goal.
Related terms and common misconceptions
- “Hashed means encrypted.” Hashes cannot be decrypted, and encrypted data has nothing to do with hash collisions. They are different tools.
- “Hashed phone numbers are anonymous.” Not on their own, for the reason above.
- “SHA-256 is broken because of bitcoin mining.” Mining computes huge numbers of hashes; it does not reverse them.
Session keys and forward secrecy are related concepts in secure protocols, where hash functions help derive keys.
Getting started
Sign up in the web app at getcchat.com/c with your phone number or email, pick an @username and decide whether to match contacts. Either way, your team can be chatting in minutes.
Frequently asked questions
Is SHA-256 encryption?
No. Encryption is reversible with a key; hashing is a one-way transformation with no key. You use encryption to hide data you need back later and hashing to fingerprint or compare data.
Can SHA-256 be reversed?
Not directly; there is no known way to compute the input from a SHA-256 hash. But if the possible inputs are few or predictable, such as phone numbers, an attacker can hash every candidate and compare. That is why minimizing what is stored matters.
What is SHA-256 used for?
It is used to verify file integrity, in digital signatures and certificates, in password-storage schemes combined with other techniques, in blockchains and to compare values privately, such as contact matching in messaging apps.
Does C Chat upload my address book?
C Chat hashes phone numbers with SHA-256 on your device before contact matching, and the server does not store those hashes. You can also reach people by @username without sharing a phone number at all.