SHA-256 hashing vs encryption

Short answer

SHA-256 is a hash function: it maps a byte sequence to a 256-bit fingerprint. It does not encrypt the text, and there is no key that “decrypts” the hash.

UTF-8 input: abc
SHA-256:
ba7816bf8f01cfea414140de5dae2223
b00361a396177a9cb410ff61f20015ad

The hexadecimal result has 64 characters. Verify the vector with the SHA-256 generator.

Useful properties

• The same byte sequence produces the same fingerprint.
• A small input change substantially changes the output.
• Output length is fixed.
• Reconstructing the original input from the fingerprint is not expected to be feasible.

FIPS 180-4 specifies SHA-256 as part of the Secure Hash Standard.

What a match proves

If you hash downloaded bytes and the result matches a fingerprint obtained through a trusted channel, you have evidence that those bytes did not change. If the file and expected hash came from the same compromised place, the comparison adds no independent authenticity.

Authenticating a message requires a construction such as a MAC or signature with appropriate keys and verification. Manually concatenating a secret and text before SHA-256 is not a substitute for a reviewed cryptographic design.

Passwords

Plain SHA-256 is fast, which helps attackers test many password candidates. Password storage needs a password-specific, salted, deliberately expensive function with maintained parameters. Base64 is not an alternative; it is reversible without a key.

Compare the exact bytes

text, text\n, and a differently normalized Unicode string produce different hashes. Document encoding, line endings, and whether a tool processes text or files. The published tool hashes UTF-8 text; it does not claim to hash a file’s raw binary contents directly.