Can you crack SHA-256?

Question

From my understanding, a hash function is an algorithm that takes a unique input and produces a unique output, and a secure hash like SHA-256 cannot be reverse engineered. I saw this thread Won't ASIC miners eventually break SHA-256 encryption? saying that it would take a ridiculously long time to crack a SHA-256 hash, but can't you just brute force it if the input is short?

For example, if an insecure password such as test123 was turned into a SHA-256 hash, and an average gpu can do around 1000 MH/s, then just by brute forcing alphanumeric characters up to 7 digits (26 + 10) ^ 7, then wouldn't it take only about (26 + 10) ^ 7/(1000*1000)/60/24 = 54 days to crack it (less with a good gpu)?

Basically what I'm trying to say is isn't the strength of a SHA-256 hash directly correlated to the length of it's input? If a really short string such as "idk" was turned into a SHA-256 hash, wouldn't it be cracked in a matter of milliseconds? (and thus proving that you can crack a SHA-256 hash)

Answer 1

There is a large difference between being able to produce the preimage for a single SHA256 hash for which you may know certain factors like length, character set, etc., and being able to break SHA256 as a whole.

Short inputs are naturally more vulnerable to brute forcing, which is why SHA256 is not a recommended hash for password storage - instead, hash functions that are deliberately designed to be slow and adjustable, such as bcrypt, are used where the input size may be small enough for practical brute forcing of hashes like SHA256.

In all applications of SHA256 in the Bitcoin Protocol, all the inputs are large enough to make a brute force attack impractical.