What Is SHA-256? Hashing Explained in Plain English

A cryptographic hash function takes any input — a single word, a long document, or an entire file — and produces a fixed-length string of characters called a hash or digest. SHA-256 always produces a 256-bit result, written as 64 hexadecimal characters, no matter how large or small the input is. The word "hello" and a 500-page book each come out as a 64-character hash.

Three properties make this useful. First, it is deterministic: the same input always produces the same hash. Second, it is extremely sensitive: changing even one character of the input produces a completely different hash. Third, it is one-way: you cannot reverse a hash to recover the original input. Together, these turn a hash into a reliable digital fingerprint for data.

When you download software, the publisher often lists the file's SHA-256 hash. After downloading, you can compute the hash of your copy and compare it to the published one. If they match, you know the file was not corrupted or tampered with in transit. If even a single byte was altered, the hashes would differ completely, and you would know something was wrong.

Hashing also underpins secure logins. Well-designed systems never store your actual password; they store a hash of it. When you log in, the system hashes what you typed and compares it to the stored hash. Because the process is one-way, even if the database is stolen, your original password is not directly exposed. The same principle secures HTTPS certificates, Git commits, and the proof-of-work behind Bitcoin.

SHA-256 is part of the SHA-2 family, which also includes SHA-512 with a longer 512-bit output. Both are considered secure today. An older algorithm, SHA-1, is now regarded as broken for security purposes because researchers demonstrated ways to engineer two different inputs that produce the same hash — a so-called collision. For anything security-sensitive, SHA-256 or SHA-512 is the modern standard, and SHA-1 should be avoided.

The reason SHA-256 remains trusted is the astronomical difficulty of finding collisions or reversing a hash. With 2 to the power of 256 possible outputs, brute-forcing it is far beyond the reach of any current or foreseeable computer. That mathematical hardness is precisely what makes it a dependable foundation for digital trust.

The easiest way to build intuition for hashing is to experiment. Type a word, note its SHA-256 hash, then change a single letter and watch the entire output transform. That dramatic, unpredictable change from a tiny edit is the heart of why hashing works — and why it quietly holds so much of the internet together.