Build SHA-256 from Scratch
Implement SHA-256 from raw bit operations. You'll build ROTR/Σ/σ/Ch/Maj, the message schedule, the 64-round compression function, padding, and the full Merkle-Damgård construction. Then add HMAC for message authentication. By the end you'll deeply understand the hash function used in Bitcoin, Git, TLS, and JWT.
intermediate12 lessons4 chapters12 graded exercisesPython
No sign-up needed for lesson 1 · certificate on completion · sign up to save progress
What you’ll have built
Chapter by chapter. Every step is a graded exercise.
- Bits, Bytes & Endianness
- The Compression Function
- Padding & Length
- Putting It Together
Starts in Python — solve in the language you choose in the editor, same tests either way.
Curriculum
4 chapters, 12 lessons. Each lesson is a short read, one graded exercise, and a quiz.
- 1Bit Operations RefresherRead · exercise · quiz
- 2Big-Endian Word PackingRead · exercise · quiz
Loading reference solution…
When the tests are green, keep going.
Read
- Serious Cryptography (Aumasson) chapter 6 — covers SHA-2 family in depth.
- FIPS 180-4 (the spec itself, ~30 pages).
- The official test vectors — verify your implementation against these before declaring victory.
Build next
- HMAC-SHA-256: ~10 lines of
outer(inner(message))on top of what you have. Foundation of JWT, TLS, almost every authenticated message format. - PBKDF2 + HKDF: key derivation built on HMAC. PBKDF2 is the password hasher; HKDF is what TLS 1.3 uses to derive session keys.
- SHA-3 / Keccak: a totally different design (sponge construction). Worth implementing once because the structure is so different from SHA-2.
- BLAKE3: modern, faster, parallelizable. The reference implementation is small + readable.
Continue with our courses
- Build JWT — uses HMAC-SHA-256 directly.
- Build TLS 1.3 — uses HMAC, HKDF, and SHA-256 throughout.
- Build a Blockchain — uses SHA-256 for proof of work and Merkle roots.