Similarly:

    BLAKE2s (32-bit words) - 554 MiB/s
    BLAKE2b (64-bit words) - 890 MiB/s

(source: https://blake2.net/)

The difference is also clear in pure JavaScript implementations — JS doesn't have native 64-bit integer operations yet, so SHA-512 is slower there:

   SHA-256 - 103.17 MiB/s
   SHA-512 -  34.29 MiB/s

Note that since SHA-512 eats 128-byte blocks, while SHA-256 64-byte blocks, hashing very short strings may be faster with SHA-256 even on 64-bit platforms (the same applies to BLAKE2).

> in pure JavaScript implementations

Is not JS cryptography a bad idea?

No JS per se. In browser client side crypto though...

Harder to defend against timing attacks in JS, which are exactly some of the strongest attacks against modern cryptosystems.

Do you mean because of the lack of low level control/bit manipulation, vs C/asm, or something else? I would have guessed it was about the same as any interpreted/jitted higher level language (python/php/c#/java).

"... amortized per byte."

SHA-512 is in fact slower per iteration, but uses twice the block size as SHA-256. For hashing e.g. files, the per-byte number is what matters. But when doing hash trees, for example, the per-iteration performance is what matters and SHA-256 wins out there.

Yep. Taking advantage of SHA512's superior performance while still producing a 256 bit result is the raison d'être of SHA-512/256.

Well... only if you ignore the advantages of immunity to length extension.

We use this fact in our ID system. Consider bloom filters... so many different 'hash functions' you get for free out of 64 bytes of hash data.

As a side note, there are some cryptocurrency project using half of the sha512, since it's faster and using a 256 bit hash saves spaces.

I would be curious to see this compared with SHA-384, and across multiple languages.

SHA-384 is exactly the same speed as SHA-512. SHA-512/256 is also the same speed -- it's basically SHA-512 with the output truncated to 256 bits.

SHA 224/384 are just truncated forms of the same algorithm as SHA 256/512, respectively. (With different initial constants, as well, but that doesn't matter for this.)