Without a salt, every user with the password 'hunter2' has the same SHA-256 hash. An attacker who steals the database can look up that hash in a precomputed table (a 'rainbow table') in milliseconds.
Add a random 16-byte salt per user before hashing, and rainbow tables become useless, the attacker has to brute-force every account individually.
Modern password hashes (bcrypt, scrypt, Argon2) generate and embed the salt for you. You should never roll your own.