What Is a SHA-256 Hash and What Is It Used For?

Published October 3, 2026 · By the ForgePDF team

A hash function turns any input, from a single word to a huge file, into a short fixed-length fingerprint. SHA-256 is one of the most widely used and produces 256 bits, written as 64 hexadecimal characters.

Properties that make hashes useful

The same input always produces the same hash. A tiny change, even one letter, produces a completely different result. The process is one-way, so you cannot recover the input from the hash, and it is practically impossible to find two different inputs with the same SHA-256 hash.

For example, the SHA-256 hash of the text abc is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. Change it to abd and the output looks entirely unrelated.

Common uses

Hashes verify file integrity: a download page publishes the expected hash, and you compare it with the hash of the file you received. They also appear in digital signatures, certificates and blockchain systems, where they link records together.

What hashes are not for

A fast hash such as SHA-256 is not a good way to store passwords, because attackers can try billions of guesses per second. Password storage should use slow, salted algorithms such as bcrypt, scrypt or Argon2. Also avoid SHA-1 for security work, since practical collision attacks against it have been demonstrated.

Try it

Type any text into our Hash Generator and watch how a small edit changes the entire output. It uses the Web Crypto API in your browser, so nothing you enter is uploaded. For account security, pair it with the advice in our guide to creating a strong password.

Related tools: Hash Generator, Password Generator

Using SHA-256 to verify a download

Suppose a software publisher provides a SHA-256 checksum alongside a download. After downloading the file, calculate its SHA-256 value and compare the result character by character with the publisher's reference. A matching digest indicates that the bytes you hashed match the reference value. It does not, by itself, tell you whether the software is trustworthy; the source of the reference matters.

Why tiny changes matter

Changing one character in a text file or one byte in a binary file should produce a dramatically different digest. This makes accidental corruption easier to detect. It also makes hashes useful for comparing files without reading their entire contents manually.

Hashing and passwords

Although SHA-256 is a cryptographic hash, storing ordinary passwords as simple SHA-256 hashes is not a complete password-security design. Password storage normally requires a password-hashing function designed to be expensive and resistant to large-scale guessing. This distinction is important because a general-purpose hash is optimized for speed, while password hashing intentionally introduces work.

Practical checksum checklist

• Get the expected checksum from a trusted source.
• Hash the exact file you downloaded.
• Compare the complete hexadecimal value.
• Do not assume a matching hash proves the file is safe.
• Keep the original reference and download source documented when verification matters.

Practical checklist

Keep the original, complete one clear task at a time, and verify the result before sharing it. This makes document work easier to troubleshoot and reduces accidental data loss. For important files, use clear filenames for the original and the working copy so you always know which version is authoritative.

ForgePDF is intended for quick browser-based utility work. The best workflow is usually the shortest sequence that produces a correct, readable result. When a document is sensitive, also review the site's privacy information and your own device security.

For everyday verification, the most important habit is comparing the complete digest rather than only the first few characters. A partial comparison can miss differences. When integrity matters, record the filename, expected checksum, and verification date so the check can be reproduced later.