I'm running a service that is using SHA-256 on two sides of the application - one is a server-side PHP implementation and the other is a client-side iOS implementation. The result of using the algorithm on both sides is the same alphanumeric string, except for the fact that all letters are capitalized on iOS and lower case on PHP. The fact that they are identical alphanumeric strings leads me to believe that SHA-256 is case insensitive, but I can't find any documentation supporting my assumption. Can someone show me some documentation to confirm this?
If you are referring to a hexadecimal string output, then yes, that is case insensitive. It is a textual representation of binary data.
http://en.wikipedia.org/wiki/Hexadecimal
The algorithm itself is most definitely case-sensitive.
If the binary representation of the input is the same on both sides the binary representation of the hash value will be the same. Hex is case insensitive.
No decent cryptographic hash function is case insensitive, because then it would be far easier to produce a collision. The output is a different matter. It's basically a large number (so casing does not apply), but for convenience it is given in base 16, i.e. using the letters a through f as additional digits. Hexadecimal notation is indeed case insensitive, or at least both upper- and lowercase variants are common and recognized. It doesn't matter and does not change what number is represented.
All SHA series are binary algorithms they know nothing about case, so they can't be case insensitive.
You can simply test this on single machine with 2 outputs from one string with different cases and you can see that they provide different results.
In your case I think if every thing is ok, possibly iOS show capitalized string in the phone but internally pass you normal( lower case ) string
来源：https://stackoverflow.com/questions/11892053/is-sha-256-case-insensitive