Every Bitcoin transaction, every block, every mined coin — all of it depends on a mathematical function called SHA-256. It's the foundation of Bitcoin's security. Understanding it doesn't require a math degree. It requires about seven minutes and a willingness to think about fingerprints.
Start with a simpler question: what is a hash function?
A hash function takes any input — a word, a sentence, an entire novel, a transaction record — and produces a fixed-length output called a hash (or digest). No matter how long or short the input, the output is always exactly the same length.
Think of it as a fingerprint machine. You feed in any document and it produces a unique 64-character fingerprint. The same document always produces the same fingerprint. But change even one character — one comma, one space — and the fingerprint changes completely and unpredictably.
Here's what that looks like in practice:
That radical sensitivity to input — where the tiniest change produces a completely different output — is called the avalanche effect, and it's one of the most important properties that makes SHA-256 useful for Bitcoin.
What makes SHA-256 special
SHA-256 stands for Secure Hash Algorithm 256-bit. It was developed by the National Security Agency (NSA) and published by the National Institute of Standards and Technology (NIST) in 2001. It's one of the SHA-2 family of algorithms and is widely considered cryptographically secure — meaning no practical attack against it has ever been found.
It has four properties that Bitcoin specifically relies on:
How Bitcoin uses SHA-256
Bitcoin uses SHA-256 in three distinct ways, each critical to how the system works.
1. Linking blocks together
Every block in the Bitcoin blockchain contains the hash of the block before it. That hash is computed from all the transaction data in the previous block. This creates the "chain" — each block is mathematically tied to the one before it.
If someone tried to go back and alter an old transaction — say, to pretend they never sent you Bitcoin — they'd change the data in that block. That would change the block's hash. Which would break its link to the next block. Which would break every subsequent block all the way to the present. The entire chain from that point forward would be invalidated. Every node on the network would immediately reject it.
This is what makes the blockchain immutable. Not a promise. Not a policy. Mathematics.
2. Mining — the puzzle that secures the network
Mining is often described as "solving a complex math problem." The problem is actually a hash puzzle, and SHA-256 is the puzzle.
When miners try to add a new block, they must find an input that produces a hash starting with a certain number of zeros. There's no shortcut — you just keep trying different inputs until you find one that works. This is called "proof of work."
The network adjusts the difficulty every two weeks so that a new block is found approximately every ten minutes — no matter how much computing power is on the network. More miners means the puzzle gets harder. Fewer miners means it gets easier. The ten-minute rhythm holds.
The miner who finds the winning hash gets to add the next block and earns the block reward (currently 3.125 Bitcoin, following the 2024 halving). Their proof is immediately verifiable by every other node — one hash computation to check, versus trillions of attempts to find it.
3. Wallet addresses
Your Bitcoin wallet address is derived from your public key using SHA-256 (plus another hash function called RIPEMD-160). This means your address is a cryptographic fingerprint of your key — not the key itself. Even if someone knows your address, they can't reverse-engineer your private key from it. SHA-256's one-way property makes that mathematically infeasible.
Why can't someone just break it?
SHA-256 produces a 256-bit output. That means there are 2²⁵⁶ possible hash values — approximately 115 quattuorvigintillion. Written out that's a 1 followed by 77 zeros.
If you had a computer that could check a trillion hashes per second, and you ran it for the entire age of the universe, you would have checked an almost incomprehensibly small fraction of all possible outputs. Breaking SHA-256 by brute force isn't a matter of needing faster computers. The numbers involved are beyond the reach of any conceivable computing technology — including quantum computers at the scales that exist today.
There's also no known mathematical shortcut. No clever trick that lets you skip steps. The NSA and NIST designed it that way, and decades of the world's cryptographers scrutinizing it have found nothing exploitable.
What does this mean for your business?
When a customer pays you in Bitcoin and that transaction gets confirmed, SHA-256 is what makes that confirmation permanent. Nobody — no government, no hacker, no disgruntled employee — can reach back into the blockchain and alter it. The transaction record is as permanent as mathematics.
There are no chargebacks because there's no authority to process one. There's no fraud because there's no signature to forge. The security isn't a company's promise to you. It's a 256-bit one-way function that the NSA spent years designing and the world's cryptographers have spent two decades trying and failing to break.
That's what's under the hood when OrangeTill generates a QR code and a customer scans it. Pretty good foundation for a roast beef payment. 🍊