What is a SHA-256 hash? A short explainer with examples
The 64-character fingerprint behind download checksums and model files, shown with real examples you can reproduce.
By ClaudeGPT Si Newsroom · Editorial team
· 2 min read
What is a SHA256 hash? It is a 64-character fingerprint of some data, made by the SHA-256 algorithm. Feed it the same input and you always get the same fingerprint; change one letter and the fingerprint looks completely different.
A quick example
Here is what the word hello looks like after SHA-256:
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
And here is Hello, with a capital H:
185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
One changed letter, nothing in common. That is the whole point: a hash makes small differences impossible to miss, even in data too long to compare by eye. You can try it yourself in the free AyeTab hash generator, which runs in your browser and does not upload what you type.
The idea in four facts
- Fixed size. SHA-256 always returns 256 bits, written as 64 hexadecimal characters. A tweet and a film file both produce one.
- Deterministic. The same bytes give the same hash on any computer, in any tool.
- One-way. You cannot run it backwards to recover the input. It is not encryption.
- Standardized. SHA-256 belongs to the SHA-2 family, which NIST specifies in FIPS 180-4. NIST describes these digests as a way to tell whether a message has changed.
Where you meet SHA-256 every day
| Where | What the hash does |
|---|---|
| Software downloads | A published checksum lets you confirm the file arrived intact |
| AI model files | Hugging Face shows a SHA256 on large file pages |
| Digital signatures | Hash functions are commonly used alongside them, as Microsoft's docs note |
| Your own debugging | Two values match only if their hashes match |
What it is not good for
SHA-256 is fast, which is great for checking files and bad for passwords. OWASP's password guidance says fast hashes like SHA-256 let attackers test guesses quickly. Password systems should use slow, salted algorithms such as Argon2id or bcrypt.
It also does not hide short or common inputs, and it is not a way to keep data secret. If someone hashes a phone number, a guesser can hash every possible phone number and find the match. The hash only protects inputs that are long and hard to guess.
SHA-256 next to its relatives
| Algorithm | Output | Status |
|---|---|---|
| MD5 | 128 bits | Not safe where collisions matter (RFC 6151) |
| SHA-1 | 160 bits | NIST says to phase it out by the end of 2030 |
| SHA-256 | 256 bits | The common default today |
| SHA-512 | 512 bits | Same family, longer output |
Make one yourself
Open the AyeTab Hash Generator, type something into the Message box and press Generate. The result appears in the Digests area, and the same tool also covers MD5, SHA-1 and SHA-512. It is free, it needs no account, and it keeps working offline once the page has loaded. If you hash things often, AyeTab for Chrome puts the same tool on your new tab page.
Hashing a file works the same way, just with more bytes. For big files, your computer already has a tool built in, so there is nothing to download: sha256sum on Linux, shasum -a 256 on macOS, or Get-FileHash in Windows PowerShell.