SHA-256, SHA-512 and SHA3-256 throughput on one PHP host
A host-specific throughput baseline for commonly available cryptographic hash functions over identical application data.
Question and test setup
How do available secure hash algorithms compare in raw throughput on this host and PHP build?
Algorithm performance will depend on CPU capabilities and library implementation, so the local ranking may differ from assumptions based on digest width.
Hash selection is primarily a security and interoperability decision. Throughput becomes operationally relevant for large artifacts, integrity manifests and high-volume content-addressed storage.
This report intentionally excludes password hashing, where dedicated slow functions and calibrated cost parameters are required.
The measured gap
What this run shows: SHA-256 delivered the highest local throughput among the available secure hashes; protocol and threat-model requirements remain the selection gate. The slowest-to-fastest median spread was 375.06% on the measured host.
| Variant | Median | Middle 50% | Operations/s | Additional measure |
|---|---|---|---|---|
| SHA-256Fastest | 75.55 µs | 75.39 µs–75.93 µs | 13,237 | — |
| SHA3-256 | 315.71 µs | 313.69 µs–316.23 µs | 3,168 | — |
| SHA-512 | 358.89 µs | 354.28 µs–360.52 µs | 2,786 | — |
What the numbers suggest
Use the result to understand local capacity, not to weaken an integrity requirement. A faster algorithm is useful only when it satisfies the protocol, threat model and compatibility constraints.
The relative ordering can change across processors, virtualized hosts and linked crypto libraries. That is precisely why the environment snapshot is published with the data.
When the difference is worth acting on
- Keep SHA-256 as a broadly interoperable integrity default unless a protocol specifies another algorithm.
- Do not use this report to select password-storage functions.
- Benchmark hash_file separately when storage throughput is part of the real workload.
Repetition and environment
- All algorithms hash the same mixed payload and consume the digest result.
- Only algorithms reported by the installed PHP hash extension are included.
- The test measures in-process hashing and does not include file I/O or encoding the digest for storage.
Open measured environment
- Measurement run
- 2026-07-22T15:23:56+00:00
- PHP
- 8.4.23 (cli)
- Operating system
- Linux 4.18.0-553.85.1.el8_10.x86_64
- Architecture
- x86_64
- Processor
- AMD EPYC-Rome Processor
- Reported host memory
- 15.02 GiB host total
- CLI OPcache
- 0
- PHP memory limit
- 1024M
- Loaded study extensions
- json, openssl, zlib, mbstring, pdo_sqlite
- Timing clock
- hrtime(true)
- Measured rounds
- 7
Reasons the ranking may move
- No hardware counters or CPU frequency controls are used.
- The test covers one payload size and in-memory input only.
Primary documentation
These sources describe the PHP functions under test. The performance ranking comes only from this published fixture and environment.