SHA-256 is not encryption — and that's the whole point

The single most common mix-up I see in code reviews: treating a hash like encryption. They are different tools for different jobs, and the difference is the reason hashing is useful at all.

The one distinction that matters

• Encryption is two-way: with the key, ciphertext → plaintext. It's for keeping something secret that you later need back.
• Hashing is one-way: input → fixed-size digest, and there is no "un-hash." SHA-256 always returns 256 bits (64 hex chars), whether you feed it one byte or a gigabyte. You cannot recover the input from the digest — not "it's hard," it's not a reversible operation.

If you ever read that a hash "can be decrypted," that text is wrong. What attackers do instead is guess-and-check: hash candidate inputs and compare digests (that's what a rainbow table or a password cracker is). That's why hashing a password needs salt + a slow KDF (bcrypt/argon2), not raw SHA-256.

The properties that make it useful

• Deterministic: same input → same digest, every time. That's what lets you verify.
• Avalanche effect: change one bit of input and ~half the output bits flip. hello and hellp produce completely unrelated digests.
• Fixed length: 256 bits regardless of input size.
• Collision-resistant: finding two inputs with the same SHA-256 is computationally infeasible (unlike SHA-1, which is broken for collisions — migrate off it).

Where you actually use it

• File integrity: publish a download's SHA-256; a user re-hashes the file and compares. Match = not tampered/corrupted.
• Change detection / caching: hash content to make an ETag or a cache key.
• Deduplication: identical content → identical digest.
• Commit/version identity: content-addressed storage (Git is the famous example).

Not for: storing passwords with raw SHA-256 (too fast — use argon2/bcrypt), and never as a stand-in for encryption.

Check a digest quickly

When I just need to verify a string's hash or compare against a published checksum, Toolonium's hash generator does it in the browser — type or paste, get the SHA-256 (and other algorithms), nothing uploaded. Good for the "does this checksum match?" moment without dropping into a shell.

Takeaway

Reach for a hash when you need to verify or fingerprint, for encryption when you need to get the data back. They're not interchangeable, and "decrypt a hash" isn't a thing. Need a quick digest? Generate one here.

Still seeing raw-SHA-256 password storage in the wild? Share the worst one you've had to fix.