The password is entered by the user and the key is processed locally. Neither the password nor the key will be stored, only used and forgotten (but hopefully not by the user). Is SHA256 by itself strong enough for this purpose? Do I really need a salt in this case?
I've looked around Google and other StackExchange questions, but they all assume the password and/or key will be stored. In any other case it probably would be stored, though my case calls for using it and forgetting it.