What Is a SHA-256 Hash (and When to Use It)?

A SHA-256 hash is a 64-character hexadecimal fingerprint of some data — any data. Feed it a single word or a two-gigabyte file and you get back the same fixed 64-hex-digit string every time. Change one byte of the input and the entire output changes unpredictably. That combination of properties is what makes hashing useful.

The three properties that matter

• One-way. You can compute the hash from the data, but you can't reverse the hash back into the data. A hash is a fingerprint, not an encrypted copy.
• Deterministic. The same input always produces the same output, so two people can independently hash a file and compare results.
• Fixed length. SHA-256 always outputs 256 bits — 64 hex characters — no matter how large or small the input is.

Try it with the Hash Generator: paste any text and watch it collapse into 64 characters.

What SHA-256 is genuinely good for

The classic use is integrity checking. Software downloads often publish a SHA-256 "checksum" next to the file. After downloading, you hash your copy with the Hash Generator and compare it to the published value. If they match, the file arrived intact and untampered; if not, something changed in transit. Hashes also power deduplication (identical files share a hash) and change detection (a file's hash tells you instantly whether it was modified).

Common mistakes

• Storing passwords as a bare SHA-256 hash. SHA-256 is fast, which is exactly wrong for passwords — attackers can try billions of guesses per second. Real password storage needs a slow, salted key-derivation function like bcrypt, scrypt, or Argon2. If you just need a strong password, generate one with the Password Generator instead of inventing a hashing scheme.
• Using MD5 for security. MD5 (and SHA-1) are broken for anything security-sensitive; deliberate collisions have been demonstrated. Use SHA-256 when the result must be trustworthy.
• Confusing hashing with encryption. Hashing is one-way and has no key; you can never "decrypt" a hash to recover the input. Encryption is two-way and reversible with a key. They solve different problems.
• Confusing hashing with encoding. Base64 (see the Base64 Encoder/Decoder) just re-represents data reversibly — it hides nothing. A hash actually discards information.

Used for verification, SHA-256 is simple and dependable. Just don't ask it to do a job — reversible secrecy, or slow password storage — that it was never designed for.