# Do I still need SHA256 if I already had a AES 256 key that is 44 characters long?

Several months ago, I was required to research AES and SHA-256 to make a secured license system for my app. However, I was dumb enough that couldn't distinguish between the 256 bits from AES and the actual SHA-256, which resulted in me making a system that generates a 256-bit long key (44 characters long base64 key) for AES-GCM encryption and decryption without the actual SHA-256. Now, it's time for me to update the system that cooperates with an AES system in PHP. But then I found the PHP resources (it's used for research purposes so it can be changed) provided to me has actually used SHA-256 which made both systems totally different. Then my question is, is the 256-bit long key secure enough that I don't actually need the SHA-256 in the PHP system?

P.S.: If I misunderstood anything in the question, I would like to apologize since I am still new to the area of cryptography...

PHP code:

<?php
echo '<pre>';

$$hash_string = 'qIANSOwtdfF4y5Yk33ZLE5s6KwKBAeu6qzJRG84Sjjo='; echo "password : "; var_dump($$hash_string);
echo '<hr>';
$$decode_string = base64_decode($$hash_string);
$$hash = hash('SHA256',$$decode_string, true);
echo "hash : ";
var_dump($$hash); echo '';$$app_cc_aes_key = substr($$hash, 0, 32);$$cipher = 'aes-256-gcm';
$$iv_len = openssl_cipher_iv_length($$cipher);
echo "app_cc_aes_key : ";
var_dump($$app_cc_aes_key); echo ''; echo "cipher :"; var_dump($$cipher);
echo '<hr>';

$$data = '7bc9d6ae-982f-11e9-bc42-526af7764f64'; echo "data : {$$data}";
echo '<hr>';

$$tag_length = 16;$$iv = openssl_random_pseudo_bytes($$iv_len);$$tag = "";
$$encrypt = openssl_encrypt($$data, $$cipher,$$app_cc_aes_key, OPENSSL_RAW_DATA, $$iv,$$tag, "", $$tag_length);$$encrypt_text = base64_encode($$iv.$$tag.$$encrypt); echo "encrypt :"; var_dump($$encrypt);
echo '<br>';
echo "encrypt_text :";