How this tool works
SHA-256 reduces any input to a fixed 256-bit fingerprint, written as sixty-four hexadecimal characters. The same input always produces the same digest, and any change at all — one character, one bit — produces a completely different one. It is one-way by design: there is no operation that turns a digest back into the text it came from.
The hashing is done by the browser's own cryptography implementation rather than by code shipped with the page, which means it is the same audited implementation the rest of the platform uses. That API is only available in a secure context, so the tool needs the page to be served over HTTPS.
What SHA-256 is right for
- It verifies integrity, not identity: comparing a file's digest against a published one tells you the file was not altered in transit. It says nothing about who produced it unless the digest itself came from a trusted source.
- It is the wrong tool for storing passwords: SHA-256 is designed to be fast, which is exactly the property an attacker guessing passwords wants. Password storage needs a deliberately slow function such as bcrypt or Argon2.
- The digest is fixed length whatever the input: one character or a gigabyte both produce sixty-four hex characters. Digest length tells you nothing about the size of what was hashed.
- Identical inputs give identical digests: which is what makes hashing useful for deduplication and caching, and also why hashing an unsalted value does not conceal it — a common value can simply be looked up.