> but 256 bits is already extremely strong The strength of hashes like SHA-256 doesn't just come from the number of output bits. The 256 bits there is relevan

> but 256 bits is already extremely strong The strength of hashes like SHA-256 doesn't just come from the number of output bits. The 256 bits there is relevant for brute force attacks, but not more sophisticated attacks that take into account the internal structure of the hash algorithm, and in some cases "weak" values. SHA-512 performs more "rounds" of computation than SHA-256. Although it's impossible to compare two different hashes on rounds alone, in general a large number of rounds of the same type of hash decreases the likelihood of non-brute-force attacks finding a collision. If you look at the literature for attacks on hashes, they will often say they could do it for a certain number of rounds, and that number increases over time as new methods are discovered. The number of rounds in the hash design is chosen with this in mind, trying to balance being more than sufficient for future attacks yet not too slow.