What a hash function does
A cryptographic hash turns any input into a fixed-length fingerprint. The same input always gives the same digest, a one-character change gives a completely different one, and there is no practical way to work backwards from the digest to the input. SHA-256 produces 64 hexadecimal characters, SHA-512 produces 128, SHA-1 produces 40, and MD5 produces 32.
Text is hashed as UTF-8 bytes, which matches sha256sum, openssl dgst and the hashing functions in most languages. Watch for invisible differences such as a trailing newline: echo "abc" | sha256sum hashes "abc\n", not "abc".
Which algorithm to choose
Use SHA-256 for new work: file integrity checks, cache keys, content addressing, signing inputs and API request signatures. SHA-512 is equally safe and can be faster on 64-bit hardware. MD5 and SHA-1 are broken for security purposes, since attackers can create two different inputs with the same digest, but they are still common for non-security checksums and in older systems.
Hashes are not for storing passwords
Plain SHA-256 is designed to be fast, which is exactly wrong for passwords: an attacker with a leaked database can try billions of guesses per second. Store passwords with a slow, salted algorithm built for the job, such as Argon2id, scrypt or bcrypt.
