I'm going to run SHA256
on a password + salt, but I don't know how long to make my VARCHAR
when setting up the MySQL database. What is a good length?
5 Answers
A sha256 is 256 bits long -- as its name indicates.
Since sha256 returns a hexadecimal representation, 4 bits are enough to encode each character (instead of 8, like for ASCII), so 256 bits would represent 64 hex characters, therefore you need a varchar(64)
, or even a char(64)
, as the length is always the same, not varying at all.
And the demo :
$hash = hash('sha256', 'hello, world!');
var_dump($hash);
Will give you :
$ php temp.php
string(64) "68e656b251e67e8358bef8483ab0d51c6619f3e7a1a9f0e75838d41ff368f728"
i.e. a string with 64 characters.
-
7can we use char(64) as the primary key or will binary(32) be better for that? (access_token)– frankishCommented Sep 15, 2013 at 10:18
-
4If you think you might want to block a user in the future, then I suggest using
varchar(65)
for a leading!
... just saying.– ManataxCommented Mar 9, 2014 at 21:42 -
148
-
6As you want to have a different salt for each password you have to store this next to the hash. For this you can use an extra field or pre-/append it to the hash, so you will need more than 64 chars Commented Apr 24, 2015 at 17:21
-
4you can use this select statement to test it:
SELECT length(to_base64(unhex(sha2('say hello to my little friend',256))))
, it is always 44 whatever the length of original string is. Commented Apr 9, 2017 at 13:57
Encoding options for SHA256's 256 bits:
- Base64: 6 bits per char =
CHAR(44)
including padding character - Hex: 4 bits per char =
CHAR(64)
- Binary: 8 bits per byte =
BINARY(32)
-
35Base64 is 3 bytes per 4 chars, so even though 32 bytes fits into 43 characters, you actually need 44. An extra = is added as the final character– WilcoCommented Jun 2, 2015 at 21:23
-
5
I prefer to use BINARY(32) since it's the optimized way!
You can place in that 32 hex digits from (00 to FF).
Therefore BINARY(32)!
-
13+1 - I like optimized...to anyone else happening on this...to use this with MySQL...you can use
UPDATE...SET hash_column=UNHEX(sha256HexString)
. Then, when retrieving it, youSELECT HEX(hash_column) AS hash_column
. Commented Sep 17, 2014 at 21:20 -
A pertinent MySQL doc: dev.mysql.com/doc/refman/8.0/en/encryption-functions.html Commented Sep 30, 2021 at 6:25
Why would you make it VARCHAR? It doesn't vary. It's always 64 characters, which can be determined by running anything into one of the online SHA-256 calculators.
-
1
-
32@hatorade: No it's not a statement, but it is a valid column type. Commented Feb 10, 2010 at 23:09
-
11varchar also doesn’t allocate space unless its used, unlike char it allocates the number of amount of total characters allowed regardless if there is data filling it.– XenlandCommented Feb 11, 2013 at 16:44
It will be fixed 64 chars, so use char(64)
-
2
-
SHA-*
to hash passwords, PLEASE read this first.crypt
for example code. SHA-x is fine for passphrases, as long as you know what you're doing.n
times to break a plain password, then adding a 16-byte salt means that it has to be runn * 256^16
times instead. Even if the password itself was trivially short - say one printable character - then SHA-x must be run3 * 10^40
times to test all possibilities. If you've got a GPU setup that runs at 11 billion SHA-256 ops/second, this is3 * 10^30
seconds. This is vastly longer than the age of the universe. Ergo, the fact that SHA-x is "fast" is utterly irrelevant.