What Is Hashing? SHA-256 Explained (and How to Generate It)
Seen a SHA-256 checksum on a download, or heard passwords are 'hashed'? This plain-English guide explains what hashing is, why it can't be reversed, how it differs from encryption, and how to generate SHA hashes online to verify files.
When you download software and see a string like "SHA-256: a3f5…", or hear that a password is "hashed," both point to the same idea: hashing. It's hugely important in security, but the concept isn't hard. Here's the plain-English version.
What is hashing?
Hashing takes data of any length and, through a fixed algorithm, turns it into a fixed-length string — a kind of "fingerprint" for the data.
hello → SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
hello! → SHA-256: ce06092fb948d9ffac7d1a376e404b26b7575bcc11ee05a4615fef4fec3a308b
Notice: one extra exclamation mark and the hash is completely different. That's one of hashing's defining traits.
Three key properties
- Consistent: the same input always gives the same hash.
- Sensitive: change the input a little and the hash changes drastically.
- One-way: you can compute a hash from data, but you can't reverse a hash back to the original.
Hashing ≠ encryption
This is the most common mix-up:
| Encryption | Hashing | |
|---|---|---|
| Reversible? | Yes (decrypt with a key) | No (irreversible) |
| Purpose | Protect content to read later | Verify, compare |
| Example | Sending a confidential file | Storing passwords, verifying files |
Storing passwords as hashes exploits the one-way property — a site doesn't store your plaintext password, only its hash; when you log in, it hashes your input and compares. Even if the database leaks, attackers don't get your original password.
SHA-256, SHA-1 or SHA-512?
| Algorithm | Notes |
|---|---|
| SHA-256 | The common standard today — secure and widely used |
| SHA-512 | Longer output, even safer |
| SHA-1 | Older, no longer secure — avoid for security uses |
| MD5 | Older still, long broken — non-security checksums only |
For general use, SHA-256 is the right choice.
The most common use: verifying downloads
Reputable sites publish a file's SHA-256 value. After downloading, compute the SHA-256 of your copy and compare:
- Match → the file is intact and untampered, safe to install
- No match → possibly corrupted or swapped — don't install it
This is especially worth doing for system images and installers.
How to generate a SHA hash
Use our SHA hash generator — paste text, pick SHA-256/384/512, and get the hash instantly. It computes with the browser's native Web Crypto, so your text is never uploaded — safe for checking data fingerprints.
The bottom line
A hash turns data into an irreversible fingerprint: same input, same output; change one character and it all changes; and it can't be reversed. Unlike encryption, encryption can be decrypted while hashing cannot — so passwords are hashed for storage and files are hashed to verify integrity. Use SHA-256 for general purposes, and generate one with the SHA hash generator. For related security basics, see how to create a strong password.
FAQ
What is a hash?
A hash takes data of any length and runs it through a fixed algorithm to produce a fixed-length 'fingerprint' string. The same input always produces the same hash, but changing the input by a single character produces a completely different hash. Its key property is that it's one-way — you can compute a hash from data, but you can't reverse a hash back into the original data. That's exactly why it's used to verify integrity and store passwords.
How is hashing different from encryption?
The big difference is reversibility. Encryption is reversible — with a key you can decrypt ciphertext back to the original, because the goal is to protect content you'll read later. Hashing is one-way and irreversible — you can't recover the original from the hash, because the goal is verification and comparison, not reading the content back. So passwords are hashed (no need to recover, only to compare), while confidential files are encrypted.
What's the difference between SHA-256, SHA-1 and SHA-512?
They're all SHA-family hash algorithms differing in output length and security. SHA-256 outputs 256 bits and SHA-512 outputs 512 bits — larger means lower collision probability and stronger; SHA-256 is the common standard today. SHA-1 is older and considered insecure, so avoid it for security uses. MD5 is older still and long broken — only suitable for non-security checksums.
How do I use a download's SHA-256 checksum?
To confirm a file wasn't tampered with or corrupted. Reputable sites publish a file's SHA-256 value; after downloading, compute the SHA-256 of your copy and compare. If they match, the file is intact and untouched; if not, it may be corrupted or swapped — don't install it. It's a good habit, especially for system images and installers.