Generating AES-256 Private Key from user string
Using a key derived from a password hash means someone could brute force this using either a known list of passwords or dictionary.

Since SHA-256 is quite fast, it's very easy to do with a moderate amount of computational power.

To better protect the key from such an attack, it is suggested to use a password derived from a key derivation function.

Some examples of these include: PBKDF2, scrypt and argon2.