- SHA-256 has hardware acceleration on many platforms, but SHA-512 mostly doesn't.
- Setting aside hardware acceleration, SHA-256 is faster on 32-bit platforms, like a lot of embedded devices. If you have to choose between "fast on a desktop" vs "fast in embedded", it can make sense to assume that desktops are always fast enough and that your bottlenecks will be in embedded.
On older 64-bit CPUs without hardware SHA-256 (i.e. up to the Skylake derivatives), SHA-512 is faster.
Many recent Arm CPUs have hardware SHA-512 (and SHA-3).
Intel will add hardware SHA-512 starting with Arrow Lake S, to be launched at the end of 2024 (the successor in desktops of the current Raptor Lake Refresh).
Most 64-bit CPUs that have been sold during the last 4 years and many of those older than that have hardware SHA-256.
- SHA-256 has hardware acceleration on many platforms, but SHA-512 mostly doesn't.
- Setting aside hardware acceleration, SHA-256 is faster on 32-bit platforms, like a lot of embedded devices. If you have to choose between "fast on a desktop" vs "fast in embedded", it can make sense to assume that desktops are always fast enough and that your bottlenecks will be in embedded.