324

I'm going to run SHA256 on a password + salt, but I don't know how long to make my VARCHAR when setting up the MySQL database. What is a good length?

10
  • 20
    Before anyone reading this decides to follow this advice and use SHA-* to hash passwords, PLEASE read this first.
    – c00000fd
    Commented May 10, 2017 at 5:31
  • 6
    Unless you’re using SHA-256 on passwords, which you shouldn’t do, the hashes have a length of 256 bits, or 64 hexadecimal characters, or 43 alphanumeric characters, or 32 bytes.
    – caw
    Commented Nov 20, 2019 at 16:01
  • @c00000fd: I'm not sure that the link is particularly relevant. The OP specifically wants to use a 'password+salt'. If the salt is 16 random characters, for example, then it doesn't matter that SHA-256 is 'fast', and dictionary attacks are then impossible. See the gnu docs for crypt for example code. SHA-x is fine for passphrases, as long as you know what you're doing.
    – EML
    Commented Sep 13, 2021 at 10:36
  • @EML: That link is the correct one for this, and it absolutely does matter that SHA-256 is fast. SHA-x is bad for passphrases, even if you know what you're doing. Commented Jan 13, 2023 at 13:07
  • @PresidentJamesK.Polk: do the sums. If SHA-x must be run n times to break a plain password, then adding a 16-byte salt means that it has to be run n * 256^16 times instead. Even if the password itself was trivially short - say one printable character - then SHA-x must be run 3 * 10^40 times to test all possibilities. If you've got a GPU setup that runs at 11 billion SHA-256 ops/second, this is 3 * 10^30 seconds. This is vastly longer than the age of the universe. Ergo, the fact that SHA-x is "fast" is utterly irrelevant.
    – EML
    Commented Jan 13, 2023 at 13:44

5 Answers 5

455

A sha256 is 256 bits long -- as its name indicates.

Since sha256 returns a hexadecimal representation, 4 bits are enough to encode each character (instead of 8, like for ASCII), so 256 bits would represent 64 hex characters, therefore you need a varchar(64), or even a char(64), as the length is always the same, not varying at all.

And the demo :

$hash = hash('sha256', 'hello, world!');
var_dump($hash);

Will give you :

$ php temp.php
string(64) "68e656b251e67e8358bef8483ab0d51c6619f3e7a1a9f0e75838d41ff368f728"

i.e. a string with 64 characters.

10
  • 7
    can we use char(64) as the primary key or will binary(32) be better for that? (access_token)
    – frankish
    Commented Sep 15, 2013 at 10:18
  • 4
    If you think you might want to block a user in the future, then I suggest using varchar(65) for a leading !... just saying.
    – Manatax
    Commented Mar 9, 2014 at 21:42
  • 148
    ...or just add a column 'blocked' ? Commented Oct 10, 2014 at 19:57
  • 6
    As you want to have a different salt for each password you have to store this next to the hash. For this you can use an extra field or pre-/append it to the hash, so you will need more than 64 chars Commented Apr 24, 2015 at 17:21
  • 4
    you can use this select statement to test it: SELECT length(to_base64(unhex(sha2('say hello to my little friend',256)))) , it is always 44 whatever the length of original string is. Commented Apr 9, 2017 at 13:57
88

Encoding options for SHA256's 256 bits:

  1. Base64: 6 bits per char = CHAR(44) including padding character
  2. Hex: 4 bits per char = CHAR(64)
  3. Binary: 8 bits per byte = BINARY(32)
2
  • 35
    Base64 is 3 bytes per 4 chars, so even though 32 bytes fits into 43 characters, you actually need 44. An extra = is added as the final character
    – Wilco
    Commented Jun 2, 2015 at 21:23
  • 5
    Well, the = can be stripped and re-added.
    – Rick James
    Commented Jan 3, 2019 at 4:16
37

I prefer to use BINARY(32) since it's the optimized way!

You can place in that 32 hex digits from (00 to FF).

Therefore BINARY(32)!

2
26

Why would you make it VARCHAR? It doesn't vary. It's always 64 characters, which can be determined by running anything into one of the online SHA-256 calculators.

3
  • 1
    is char(64) a valid mysql statement?
    – Tony Stark
    Commented Feb 10, 2010 at 23:07
  • 32
    @hatorade: No it's not a statement, but it is a valid column type.
    – Mark Byers
    Commented Feb 10, 2010 at 23:09
  • 11
    varchar also doesn’t allocate space unless its used, unlike char it allocates the number of amount of total characters allowed regardless if there is data filling it.
    – Xenland
    Commented Feb 11, 2013 at 16:44
8

It will be fixed 64 chars, so use char(64)

2
  • 2
    And use CHARACTER SET ascii.
    – Rick James
    Commented Jan 3, 2019 at 4:17
  • Or BINARY(64)as you not really dealing with text here.
    – theking2
    Commented Jan 8, 2023 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.