SHA-256 is a cryptographic hash function that turns any input into a fixed 256-bit value, usually shown as a 64-character hexadecimal string. The same input always produces the same hash, but even a tiny change in the input creates a very different result. That makes SHA-256 useful for integrity checking, file identification, and digital forensics.
In cyber security, SHA-256 often appears as a file fingerprint, malware sample identifier, or evidence marker in incident reports and threat-intel feeds. Defenders use it to compare suspicious files against known-good or known-bad hashes, verify downloads, and detect tampering. Attackers may also use hash strings in claims, leak posts, or tooling to label artifacts without revealing their contents. A hash alone does not prove compromise; analysts must validate it against logs, samples, or other evidence before drawing conclusions.