What is the proper way to generate a fixed length key from a variable length password? The password is entered by the user and the key is processed locally. Neither the password nor the key will be stored, only used and forgotten (but hopefully not by the user). Is SHA256 by itself strong enough for this purpose? Do I really need a salt in this case?    

I've looked around Google and other StackExchange questions, but they all assume the password and/or key will be stored. In any other case it probably would be stored, though my case calls for using it and forgetting it.
Using simply a hash function is not strong enough, even if the key is not stored. We the users tend to choose very crappy passwords, such as "1234" or "password". If you only use a hash function for generating the key, then there are a lot of chances that the generated keys are SHA256("1234") or SHA256("password"). That is, this method is very vulnerable to brute-force attacks. An attacker could simply hash common passwords, similarly to a dictionary attack.

It is also possible to perform brute-force attacks on established key derivation methods, such as PBKDF2 and scrypt, but the probability of success is extremely small. These methods are specifically designed for this, for example by using a salt value (in order to prevent dictionary attacks) and a lot of iterations of the hash function (in order to slow brute-force attacks).