Hashing and encryption are often mentioned together, but they do very different jobs. Mixing them up leads to real security mistakes. This guide explains each one, what a SHA-256 hash is good for and what it should never be used for.
Encryption: reversible with a key
Encryption scrambles data so that only someone with the correct key can read it. It is designed to be reversed: you encrypt a message, send it, and the receiver decrypts it back into the original. Use encryption when you need to keep information secret but still use it later, such as messages, stored files or data traveling over a network.
Hashing: a one-way fingerprint
A hash function turns any input into a fixed-length fingerprint. SHA-256, for example, always produces 256 bits, usually shown as 64 hexadecimal characters, whether the input is one letter or a multi-gigabyte file. Hashing has no key and cannot be reversed to recover the input.
Properties of a good hash
- Deterministic. The same input always gives the same hash.
- Avalanche effect. Changing one character changes the hash completely.
- One-way. You cannot work backwards from the hash to the input.
- Collision resistant. It is practically impossible to find two different inputs with the same hash.
Practical uses of SHA-256
Verifying downloads
Software publishers often list the SHA-256 hash of a file. After downloading, you hash the file yourself and compare. If the two values match exactly, the file was not corrupted or tampered with. You can do this with our Hash Generator or the dedicated SHA-256 Generator, which hash files locally in your browser.
Detecting changes
Comparing hashes is a fast way to check whether two files or texts are identical, without comparing them byte by byte.
Digital signatures and blockchains
Hashes are building blocks in digital signatures, certificates and many other security systems.
Which algorithms to avoid
MD5 and SHA-1 are considered broken for security purposes, because practical collision attacks exist. They can still be used for non-security checks, such as detecting accidental file corruption, but for anything related to security choose SHA-256 or stronger.
Passwords are a special case
Do not store passwords as plain SHA-256 hashes. General-purpose hash functions are very fast, which lets attackers test billions of guesses per second, and identical passwords produce identical hashes. Instead, use a dedicated password-hashing algorithm such as Argon2, bcrypt or scrypt, which are deliberately slow and use a unique random salt for every password. If you are a user rather than a developer, the best protection is a long, unique password for every account, which you can create with our Password Generator and learn more about in our strong password tips.
Quick summary
- Need to hide data and read it again later? Use encryption.
- Need to check that data has not changed? Use a hash.
- Need to store passwords? Use a slow, salted password hash, not plain SHA-256.
- Need to put binary data into text? That is encoding (Base64), which provides no secrecy at all.
Frequently asked questions
Can a SHA-256 hash be reversed?
Not by calculation. Attackers can only guess inputs and compare hashes, which works for short or common inputs such as weak passwords. That is why long random passwords and slow, salted password hashes matter.
Can two different files have the same SHA-256 hash?
In theory yes, because there are more possible files than hashes. In practice, as far as is publicly known, nobody has been able to produce such a collision, which is why SHA-256 is trusted for integrity checks.
Is MD5 still okay to use?
Only for non-security checks, such as spotting accidental file corruption. For anything security-related, use SHA-256 or stronger.