Git veteran warns: avoid SHA256 repos at Git 3 launch, they won't work for years

vmg · x · 2026-10-01

A heated debate is brewing over Git 3.0's plan to switch its default hash algorithm to SHA-256. Quoting Scott Chacon — who, after watching @nasamuffin's SHA-256 talk at Git Merge, argued the default switch is a huge mistake that shouldn't happen — famed Git developer vmg weighed in: "Scott is right. The SHA256 default in Git 3 is an extremely expensive piece of security theater." His blunt advice: when Git 3 ships, stay away from SHA256 repositories, because they are "not going to work at launch, and it'll be many years until they do." A major infrastructure change worth every Git user's attention.

Original post →

More from coding & agent

coding & agent channel →