A SHA-256 digest is 32 bytes whatever the input size; changing one bit of the input changes about half of the output bits. Digests identify content wherever byte-exact integrity matters: container images (sha256:…), Git objects, Subresource Integrity attributes (sha384-…), lockfile integrity fields, HTTP Content-Digest (RFC 9530), JWK thumbprints and certificate fingerprints.
Signatures sign digests: ECDSA and RSA hash the message first, CMS signs a digest of the content plus signed attributes, and a JWS signs a digest of header.payload. A digest only protects data if the reference digest itself comes from a trusted source; publishing sha256sum output next to a download on the same server protects against corruption, not against a compromised server.
Always record the algorithm with the value (sha256:…, multihash, an OID in DigestInfo), compare digests in constant time when they act as secrets, and do not truncate them below 128 bits of collision resistance for security uses.