A 256-bit cryptographic hash from the SHA-2 family, standardised in FIPS 180-4
SHA-256 is a cryptographic hash function that produces a 256-bit (32-byte) output, part of the SHA-2 family standardised by NIST in FIPS 180-4.
It was published in 2001 as a successor to the compromised SHA-1, and a quarter-century later it remains unbroken in public cryptanalysis — no practical collision, no practical pre-image attack. That track record is why SHA-256 shows up everywhere integrity matters: TLS certificates, Git commit IDs, macOS code signatures, Bitcoin’s proof-of-work, and the content-addressed storage underneath most modern backup engines. The output is usually written as a 64-character hex string; small enough to log, large enough that the odds of two different files colliding are cosmically small.
SHA-256 is fast on modern CPUs, especially Apple silicon, which has dedicated instructions for it. That matters at backup time: hashing a 250 GB Lightroom catalog during a scan is CPU-bound, and the difference between a fast hash and a slow one is whether your first backup finishes overnight or over the weekend.
In macup, SHA-256 is the fingerprint your repository speaks in. Every chunk is addressed by its SHA-256; verification recomputes it to prove the chunk on disk is byte-for-byte the one we wrote; dedup uses it to collapse identical blocks across your Documents, Desktop, and Photos backup sets into a single stored copy.