What is a SHA-224 hash?
SHA-224 is a member of the SHA-2 family that turns any input into a 224-bit digest, printed as 56 hexadecimal characters. It's defined in NIST's Secure Hash Standard, FIPS 180-4, and is essentially SHA-256 run from different starting values with the final 32 bits dropped. Use it when a protocol or specification names it.
The reason it exists is historical. RFC 3874, which registered SHA-224 for use in IETF protocols, explains that NIST's key-management guidance had a hash function for every security level except 112 bits, the strength of Triple-DES. SHA-224 filled that gap.
SHA-224 next to SHA-256
Both use 32-bit words, 64-byte blocks and 64 rounds of the same compression function. The differences are all at the edges:
| SHA-224 | SHA-256 | |
|---|---|---|
| First initial hash word (H0) | c1059ed8 | 6a09e667 |
| Words kept from the final state | 7 of 8 | 8 of 8 |
| Digest length | 224 bits, 56 hex chars | 256 bits, 64 hex chars |
| Collision resistance | 112 bits | 128 bits |
| Available in Web Crypto | No | Yes |
The different starting values are the important part. Without them, anyone who saw a SHA-256 digest could chop off the end and claim it as a SHA-224 digest of the same data. The FIPS starting values keep the two functions independent:
SHA-224("abc") = 23097d223405d8228642a477bda255b32aadbce4bda0b3f7e36c9da7
SHA-256("abc"), first 56 = ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61
The SHA-224 line is the example value NIST publishes for this input, and it's what this tool returns.
Using the generator
- Enter your text. It's encoded as UTF-8 before hashing, byte for byte, with nothing trimmed.
- Click Generate.
- Copy the 56-character lowercase hex digest.
An empty input box produces no output. If you need the hash of the empty string, it's d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f.
To check a result outside the browser, Linux has sha224sum in coreutils, and OpenSSL works everywhere:
printf '%s' 'hello world' | openssl dgst -sha224
It prints 2f05477fc24bb4faefd86517156dafdecec45b8ad3cf2522a563582b, the same digest this page produces for hello world. Use printf rather than echo, which adds a newline and changes the hash.
A note on length extension
Plain SHA-256 leaks its whole internal state in the digest, which is what makes length-extension attacks possible: given SHA-256(secret + message), an attacker can compute the hash of secret + message + more without knowing the secret. SHA-224 hides 32 bits of the state, so an attacker would have to guess those bits first. Thirty-two bits is about four billion guesses, which is a nuisance and not a defence. If you need to authenticate a message, use an HMAC generator instead of hashing a secret together with the data. If you want a 224-bit digest that does resist extension properly, SHA-512/224 discards far more of its state.
Should you use SHA-224?
Mostly when something requires it: an existing database column sized for 56 hex characters, an interoperability spec that lists it, or a test suite that covers every FIPS 180-4 function. NIST rates its strength at 112 bits (SP 800-107 Rev. 1 lists the collision and preimage strengths for each SHA-2 function), and the October 2024 draft of SP 800-131A Rev. 3 proposes retiring the 224-bit hash functions. Saving four bytes over SHA-256 is rarely worth that.
For new designs, pick SHA-256 from the hash generator. If you specifically want a 224-bit output from a different design family, the SHA3-224 generator gives one built on Keccak.
Last updated