SHA-256 Hash Generator

A hash function turns an input of any size into a fixed-length output. SHA-256 always produces 256 bits, that is 64 hexadecimal characters, whether you feed it one letter or a multi-gigabyte file. The same input always produces the same output, and flipping a single bit changes roughly half the bits of the result, an effect known as the avalanche property.

What matters is that the operation cannot be undone. You cannot recover the original input from a hash except by trying candidates one at a time, and for an input with enough entropy that is computationally infeasible. Nor is any practical way known to find two different inputs with the same SHA-256 hash, which is what collision resistance means.

In crypto, SHA-256 is the function Bitcoin is built on. Proof of work consists of searching for a block header whose double SHA-256 falls below a target, transaction identifiers are SHA-256 hashes, and the Merkle tree summarising a block's transactions is built from them too. Off-chain it is used for integrity checks: comparing the hash of a downloaded file against the one the developer publishes proves the file has not been altered.

SHA-1 is still included here because it appears in legacy systems, but let us be clear: it is broken. A practical collision was demonstrated in 2017, and since then it should not be used for anything security-dependent. It is also worth not confusing general hashing with password hashing: SHA-256 is deliberately fast, and that speed is exactly what makes brute-forcing a password easy. Passwords call for deliberately slow functions like bcrypt, scrypt or Argon2.