That is the maximum, but the number of bytes returned is based on the hashing algorithm used:
The output conforms to the algorithm standard: 128 bits (16 bytes) for MD2, MD4, and MD5; 160 bits (20 bytes) for SHA and SHA1; 256 bits (32 bytes) for SHA2_256, and 512 bits (64 bytes) for SHA2_512.
I'm somewhat confused now. I wanted the SHA256 to give an ASCII output (see this previous thread), because I need the output to be matched against the output of other application.
When I use a variable (see ditto post) I can get an ASCII output. However, if I run HASHBYTES on a query, according to Lynn and also to Lowell, I get a VARBINARY of up to 8,000 chars??
Do I need to convert it to VARCHAR to make it 'readable' and match it against other software (say, R) using ASCII code?
First, it is not up to 8000 characters, it is up to 8000 bytes. Also, not knowing R I would guess that if R has a hash function it would return a value similar to that returned by SQL. Also, run the following and tell me if the character version of the hash makes any sense.
DECLARE @testval VARCHAR(20) = 'qwertyuiopasdfghjklz';
SELECT
@testval TestVal
, HASHBYTES('SHA2_256',@testval) TestValHash
, LEN(HASHBYTES('SHA2_256',@testval)) LenOfTestValHash
, CAST(HASHBYTES('SHA2_256',@testval) AS VARCHAR(64)) CharVersionOfHash
, LEN(CAST(HASHBYTES('SHA2_256',@testval) AS VARCHAR(64))) LenOfCharVersionOfHash;