What Is a Hash Function? SHA-256 Explained.

A hash function turns a document, photo, message, video, or program into a compact digital fingerprint. That fingerprint gives you a simple way to check whether the data has changed.

Think of a sealed package

When a parcel arrives, a tamper-evident seal helps you notice whether it was opened along the way. A hash plays a similar role for digital information. The sender calculates a fingerprint before sending the file. The receiver calculates it again after downloading it. If the fingerprints match, the file arrived unchanged.

The fingerprint is called a hash. The mathematical process that creates it is called a hash function.

What is SHA-256?

SHA-256 is a widely used cryptographic hash function. “SHA” means Secure Hash Algorithm, and “256” refers to its 256-bit output. We usually display that output as 64 hexadecimal characters: the digits 0–9 and the letters a–f.

A short message and a multi-gigabyte video both produce a fingerprint of the same length. The same input always produces the same hash. Change even one byte, and the resulting fingerprint changes dramatically.

Do not trust this page. Verify it elsewhere.

You should not have to trust the tool on this page.

SHA-256 is deterministic. Give the same bytes to another correct SHA-256 implementation and you should get exactly the same 64-character fingerprint.

Try the same file with two independent browser tools.

CyberChef

CyberChef is an open-source browser tool developed by GCHQ.

1. Open CyberChef.
2. Drag your file into the Input area.
3. Add the SHA2 operation.
4. Select 256.
5. Compare the result with the hash from the ProofStamp lab above.

CyberChef processes the file inside your browser.

A simpler SHA-256 file checker

EMN178 SHA256 File Checksum is a simpler tool dedicated to file hashing.

Choose your file and it will calculate its SHA-256 fingerprint locally in your browser.

Now compare all three results.

Same bytes → same SHA-256 hash.

That is the useful part. You can reproduce the result independently. Verification does not have to depend on one website or one company.

Hash the file directly on your computer

You do not need a website at all.

Windows

Open PowerShell and run:

Get-FileHash "C:\path\to\your-file.pdf" -Algorithm SHA256

macOS

Open Terminal and run:

shasum -a 256 "/path/to/your-file.pdf"

Linux

Open a terminal and run:

sha256sum "/path/to/your-file.pdf"

Each command calculates the fingerprint on your own machine.

For sensitive or very large files, local hashing is often the simplest approach. The file never needs to be given to a website.

Try a small experiment

1. Hash a file.
2. Make a tiny change to it.
3. Hash it again.
4. Compare the two fingerprints.

Even a one-byte change will produce a very different SHA-256 result.

Then restore the original file and hash it again. The original fingerprint comes back.

That repeatability is what makes hashes useful for verification.

Four properties that make hashes useful

Where you already encounter hashes

• Software downloads: publishers provide a checksum so you can confirm that a downloaded file matches the expected version.
• Cloud storage and backups: systems compare hashes to detect corruption and avoid storing duplicate files.
• Digital signatures: signatures commonly protect a hash of the document rather than processing the entire document directly.
• Version control: tools use hashes to identify exact versions of code and data.
• Verifiable proofs: a hash can be timestamped publicly without publishing the original document or file.

What a matching hash proves and what it does not

One important catch: the reference hash must be trustworthy

Imagine downloading software from a compromised website. An attacker replaces the installer and also replaces the checksum shown beside it. You calculate the hash and it matches perfectly, but you have only proved that the malicious file matches the malicious checksum.

A hash verifies integrity against a reference. It does not establish where that reference came from.

That is why hashes are often combined with digital signatures, trusted timestamps, authenticated publishers, or public records.

From a hash to verifiable proof

A hash answers what: which exact data are we talking about? A timestamp can add by when: when was that fingerprint already recorded? If identity matters, a signature or verified account can also help establish who.

That creates a simple chain of evidence:

A public blockchain is one way to provide a timestamp. It does not validate whether the document is true. It records that a particular fingerprint had been committed to a public record by a particular point in time.

ProofStamp’s principle is straightforward: the original can stay private while the proof can be checked independently.

Frequently asked questions

Is a hash the same as encryption?

No. Encryption is designed to be reversed with a key. A cryptographic hash is designed as a one-way fingerprint.

Can somebody reconstruct my file from its SHA-256 hash?

Not for a normal, complex file. But a hash is not a safe way to hide a short or predictable secret: someone can hash likely guesses and compare the results.

Does SHA-256 prove when my file existed?

No. SHA-256 itself contains no timestamp. You need a separate timestamping mechanism if you want evidence that a particular hash had already been recorded by a particular time.

Is SHA-256 a blockchain?

No. SHA-256 is a hash function. Blockchains can use cryptographic hash functions, but hashing and blockchain are different things.

Why not use MD5 or SHA-1?

They can still detect accidental copying errors, but they are no longer recommended when security or adversarial tampering matters. SHA-256 is a safer modern default.

Does hashing upload my file?

Hashing can happen entirely on your device. The interactive lab on this page does exactly that: your text and files never leave your browser.