What Is the Minimum Recommended Output Size for a Secure Cryptographic Hash Function Today?

The minimum recommended output size for a secure cryptographic hash function today is generally 256 bits. This size is necessary to provide adequate resistance against both preimage and collision attacks.

A 256-bit hash offers a theoretical 2256 resistance against preimage attacks and 2128 resistance against collision attacks (due to the Birthday Paradox), which is computationally infeasible for the foreseeable future, including against potential quantum attacks.

Besides Pre-Image Resistance, What Is Another Crucial Security Property of a Cryptographic Hash Function?
What Is the Estimated Computational Power Needed to Reverse a 256-Bit ECDSA Key?
How Does the Size of the Hash Output (E.g. SHA-256) Relate to the Nonce?
Why Is Collision Resistance Generally Considered a Stronger Requirement than Preimage Resistance?
What Is a Hash Collision and Why Is a 256-Bit Output Size Considered Resistant to It?
What Is the Specific Output Length of a Bitcoin Address in Bits?
What Is a Second-Preimage Attack and How Does It Differ from a First-Preimage Attack?
How Is the Concept of a “Hash Collision” a Theoretical Security Risk for Merkle Trees?

Glossar