which hashing algorithm is better to use to store a password,
I know that
sha512 is more secure than
sha256 but I was wondering if it has some disadvantages or it is completely better than
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
To expand on the point that @cthulhu makes in his comment, the correct answer to this is "nether". SHA2 family hashing algorithms are not designed for password storage and unless you have no choice but to use a general purpose hashing algorithm, they should not be used.
To quote this answer the main reasons for this are
A basic hash function, even if secure as a hash function, is not appropriate for password hashing, because:
it is unsalted, allowing for parallel attacks (rainbow tables for MD5 or SHA-1 can be obtained for free, you do not even need to recompute them yourself);
it is way too fast, and gets faster with technological advances. With a recent GPU (i.e. off-the-shelf consumer product which everybody can buy), hashing rate is counted in billions of passwords per second.
In fact, they are the same hashing algorithm: SHA2, just with two different digest sizes.
It is "cheaper" (faster) to generate SHA256 than SHA512. So from the security perspective a potential attacker will need more time to generate all possible SHA512 hashes to brute force a hashed password from your database.
So the one obvious disadvantage of SHA512 is performance, but in ~99.9% applications you wouldn't see a difference, because usually programs calculate just one hash at the time.
In this PDF document on page 3/11 you can find a time table how long it takes to generate hashes for many different hashing algorithms, just to let you rough understanding of differences between them. The document isn't brand new, so the number nowadays are smaller (due to the bigger computer power). But you will see that SHA512 consumes more time than SHA256 anyway.
EDIT: Just like colleagues said in the comments below: SHA hasn't made for password storage purpose and therefore it shouldn't be used for it.