SHA-256 hashing basics: fingerprints, not passwords
Understand what a SHA-256 hash proves, why small input changes matter, and why password storage needs a dedicated password hash.
What a hash does
SHA-256 turns any input into a fixed-length 256-bit digest, usually displayed as 64 hexadecimal characters. It is designed to be one-way: you can calculate a hash from a file or message, but you cannot feasibly reconstruct the original input from the digest alone.
Why tiny changes produce a new result
A secure cryptographic hash has an avalanche effect. Changing one character in a document produces a digest that looks completely unrelated to the previous one. That makes hashes useful for detecting accidental corruption and checking whether a downloaded file matches the value published by its source.
Do not use plain SHA-256 for passwords
Fast hashes make password guessing too cheap. Passwords should be stored with a purpose-built, salted password-hashing algorithm such as Argon2id, bcrypt or scrypt, using parameters appropriate for your environment. A SHA-256 digest is valuable for integrity checks, but it is not password protection.
Compare fingerprints quickly
Use the SHA-256 Hash tool to create a digest for a snippet, file content or test value, then compare it with the expected fingerprint. For sensitive production material, use the controls and procedures required by your security workflow.
Try it in Code Formatter Pro
Every tool mentioned in this article runs entirely inside your browser — no signup, no uploads.
Open the toolkit