When you need to compute an HMAC, you have to choose which hash function to use inside it. The two practical choices are SHA-256 and SHA-512. Both produce secure HMACs. Both are recommended by NIST. Both are available in every modern crypto library. So which one should you pick?
The short answer is: it usually does not matter, but there are a few cases where one is a better fit. Let's look at the differences.
Security: Both Are Equal
First, let's get the security question out of the way. HMAC-SHA256 and HMAC-SHA512 are both secure. There are no known practical attacks against either. The security of HMAC is bounded by the output size of the hash function, so HMAC-SHA256 provides 128 bits of security (half the 256-bit output, due to the birthday bound) and HMAC-SHA512 provides 256 bits of security.
Both of these are far beyond what any attacker can brute-force. 128 bits of security means 2^128 operations, which is approximately 3.4 x 10^38. Even if every atom in the universe were a computer doing one billion operations per second, it would take vastly longer than the age of the universe to exhaust this space.
So from a pure security standpoint, there is no meaningful difference. You should choose based on other factors.
Performance: It Depends on Your Platform
The interesting difference is performance, and it depends on the architecture of your system.
**SHA-256** uses 32-bit words and a 64-byte block size. It was designed to work well on 32-bit processors. On 32-bit systems (including some embedded devices and older hardware), SHA-256 is faster than SHA-512.
**SHA-512** uses 64-bit words and a 128-byte block size. It was designed for 64-bit processors. On 64-bit systems, SHA-512 can be faster than SHA-256 because it processes 64-bit words natively and handles larger blocks, meaning fewer calls to the compression function for the same amount of data.
In practice, on a modern 64-bit server or desktop, SHA-512 is often 10-30% faster than SHA-256 for large inputs. For small inputs (like webhook bodies or JWT payloads), the difference is negligible because the overhead of setting up the hash dominates.
If you are working in a browser using the Web Crypto API, both are available and performance is similar. If you are on a server, benchmark both and pick the faster one. If you are on an embedded device, SHA-256 is likely the better choice.
Output Size: 32 Bytes vs 64 Bytes
HMAC-SHA256 produces a 32-byte (256-bit) output. HMAC-SHA512 produces a 64-byte (512-bit) output.
For most use cases, 32 bytes is plenty. A 256-bit HMAC gives 128 bits of security, which is more than enough. The extra 32 bytes of HMAC-SHA512 do not provide meaningful additional security. They just take up more space.
If you are storing HMACs in a database, using them as JWT signatures, or including them in HTTP headers, the smaller size of HMAC-SHA256 is a minor advantage. Shorter signatures mean smaller requests and less storage.
If you want the performance characteristics of SHA-512 but the output size of SHA-256, you can truncate HMAC-SHA512 to 256 bits. NIST approves truncating HMAC output to at least half the hash output length, so taking the first 32 bytes of a 64-byte HMAC-SHA512 is perfectly secure. This gives you the best of both worlds on 64-bit systems.
Which One Do the Standards Use?
Different standards and platforms have different defaults:
**JWT** uses HS256 (HMAC-SHA256) as the default symmetric signing algorithm. HS512 (HMAC-SHA512) is also defined but less commonly used. If you are signing JWTs, HMAC-SHA256 is the conventional choice.
**Stripe webhooks** use HMAC-SHA256. If you are verifying Stripe signatures, you are using SHA-256 whether you think about it or not.
**AWS Signature Version 4** uses HMAC-SHA256 throughout the signing chain. Every step of the SigV4 process uses SHA-256.
**IPsec** uses HMAC-SHA-256-128 (HMAC-SHA256 truncated to 128 bits) as a standard choice for integrity protection.
The prevalence of HMAC-SHA256 in major standards means it is the safer default choice for interoperability. If you are building a system that needs to work with existing standards, SHA-256 is more likely to be expected.
When to Choose HMAC-SHA512
Choose HMAC-SHA512 when:
- You are on a 64-bit platform where SHA-512 is measurably faster - You are processing large amounts of data and the performance difference matters - You want maximum security margin and do not care about output size - Your system already uses SHA-512 for other purposes and you want consistency
When to Choose HMAC-SHA256
Choose HMAC-SHA256 when:
- You want the more widely used and expected option - You are working with standards like JWT, Stripe, or AWS that use SHA-256 - You are on a 32-bit platform where SHA-256 is faster - You want smaller output sizes for storage or transmission - You are working in a browser and want the more commonly tested path
The Bottom Line
For most applications, HMAC-SHA256 is the default choice. It is what the major standards use, it produces smaller outputs, and it is fast enough on any modern platform. You will not go wrong with it.
If you have a specific reason to prefer SHA-512 (64-bit performance, existing SHA-512 usage, maximum security margin), it is an equally valid choice. Just be consistent within your system.
Both are secure. Both are fast. Both are well-supported. The choice is a matter of fitting your platform and ecosystem, not a matter of one being safer than the other.
To see the difference for yourself, try computing both with our HMAC generator. Hash the same message with the same key using both SHA-256 and SHA-512, and compare the output sizes and computation times.
For the broader context of how HMAC works and why it is different from a plain hash, read our HMAC vs hash explained guide.
