> The thing is you don't know the length of the password. It could be more than the number of hydrogen atoms in the universe, or 12.
I'll take 12 then.
I'll take 12 then.
In fact because functions like sha256 are iterative it's possible to hash a password which is longer than the RAM in a system. Technically possible to hash a password which is longer than storage in a system too, if you don't care about storing the password.
In a secure hash function, all output bits are without bias. So all combinations exist.
Can we prove it has the much simpler property that toggling one bit of the input will, on average, toggle half of the bits in the output? (Probably not.)
If you calculate a billion sha256 hashes and look at the results you'll have an even enough distribution to say it's proven, but, it's not "mathematically" proven.