A hash function takes an input of any length, a single word or an entire gigabyte-sized file, and produces a fixed-size output called a hash or digest, for SHA-256 that's always exactly 256 bits, shown as 64 hexadecimal characters. What makes a cryptographic hash function useful isn't compression, it's that going from input to hash is trivially fast, while going backward from hash to input is, by design, practically impossible.
Why reversal isn't just hard, it's fundamentally different from encryption
Encryption is deliberately built to be reversible by anyone holding the right key, that's the entire point of encrypting something you intend to read again later. Hashing has no key and no decryption function at all, it's a one-directional transformation. Part of why it can't be reversed is pigeonhole logic: SHA-256 can take input of any length and always produces a 256-bit output, so there are vastly more possible inputs than possible outputs, meaning multiple different inputs technically must share the same hash somewhere (called a collision), but finding even one such pair for a secure hash function is computationally infeasible with current technology, let alone reconstructing a specific original input from its hash.
A good hash function also has the avalanche effect: changing even a single character of the input produces a completely different, unrelated-looking hash. That property is exactly why hashes are useful for detecting even the tiniest change to a file or message, there's no partial similarity between hashes of similar inputs to exploit.
What hashing is actually used for
Password storage is the most common use: a website should never store your actual password, it stores a hash of it (with additional safeguards like salting), and when you log in, it hashes what you typed and compares the two hashes. Even if the database leaks, an attacker gets hashes, not passwords, and can't reverse them back to the originals directly. File integrity checking is another major use case: publishers post a file's SHA-256 hash alongside a download, and after downloading, you hash the file yourself and compare it against the published value using something like Compare File Hashes, if even one bit differs, the hashes won't match, immediately flagging a corrupted or tampered download.
Hashing also underpins version control (Git identifies every commit and file by a hash of its contents), digital signatures, and deduplication systems that detect identical files by comparing hashes instead of comparing entire file contents byte by byte. You can generate hashes of arbitrary text or compare them directly using the Hash Generator.
Why 'cracking' a hash isn't actually reversing it
When you hear about a hashed password being "cracked," that's not reversal, it's guessing: an attacker hashes a huge number of candidate passwords (dictionary words, common patterns, leaked password lists) and checks whether any of those hashes match the stolen one. If your original password was long, random, and not in any common list, this brute-force approach becomes computationally impractical, which is why password strength still matters even though the stored value is only ever a hash, not the plaintext.