You are right about the first part. Sha-256 is a hash function, but it's not symmetric encryption.
symmetric encryption dictates a given key K can be used to both transform plain text into cipher text and vice-versa.
A hashing function cannot be reversed because it's a large to small key space function, meaning it's only one way, there's no reversing a hash, unless you try all possibilities until you get the result.
There are publica tables on some hashing algos, they are giant covering hashs for the most known combinations.
But, a SHA-256 as the name suggests generates a 256-bit output.
Since one bit can be represented with two distincts values (i.e. 0 and 1)
we have all the possible combinations being 2^256 which is a number I not even know the name.
about the string password, that a myth that must fall at any cost.
Humans can NEVER produce strong passwords. It's up to the software engineers and cryptographers to move from a low entropy input to a large entropy input while balancing the computational recurrent cost.
:)
Eloquently put ;)