What is SHA3-224?
SHA3-224 is the smallest fixed-length member of the SHA-3 family, standardized by NIST in FIPS 202. It hashes any input to 224 bits, shown as 56 hex characters, using the Keccak sponge construction rather than the Merkle-Damgard design behind SHA-2. Type text, click Generate, and copy the lowercase result.
SHA-3 came out of a public NIST competition won by the Keccak team. It wasn't created because SHA-2 was broken (it isn't); the goal was a standard built on a different principle, so a future attack on one family wouldn't automatically reach the other.
How the sponge produces a SHA3-224 digest
Keccak keeps a 1,600-bit state, split into two parts: the rate, which input touches directly, and the capacity, which is never exposed. For SHA3-224 the capacity is twice the output length, 448 bits, which leaves a rate of 1,152 bits, or 144 bytes.
- The text is encoded as UTF-8 bytes.
- SHA-3 padding is added: the domain bits
01, then a1, zeros, and a final1, so the length becomes a multiple of 144 bytes. (In the code that's the byte0x06up front and0x80at the end.) - Absorb: each 144-byte block is XORed into the rate portion of the state, and the whole state is scrambled by the Keccak-f[1600] permutation (24 rounds).
- Squeeze: the first 28 bytes of the state are read out as the digest.
Because SHA3-224 has the largest rate of the four SHA-3 hash functions, it absorbs the most data per permutation and is the quickest of the four on long inputs. Short strings like the ones you'd paste here need only a single block.
Check it against the NIST example
NIST publishes example values for every FIPS 202 function. The classic input abc gives:
e642824c3f8cf24ad09234ee7d3c766fc9a3a5168d0c94ad73b46fdf
That's what this page returns. A second reference point: hello world hashes to dfb7f18c77e928bb56faeb2da27291bd790bc1045cde45f3210bb6c5. On the command line, printf '%s' 'abc' | openssl dgst -sha3-224 gives the same value with OpenSSL 1.1.1 or newer.
Three 224-bit hashes compared
| SHA-224 | SHA-512/224 | SHA3-224 | |
|---|---|---|---|
| Standard | FIPS 180-4 | FIPS 180-4 | FIPS 202 |
| Construction | Merkle-Damgard | Merkle-Damgard | Sponge |
| Block or rate | 64 bytes | 128 bytes | 144 bytes |
| Length-extension resistant | Barely (32 hidden bits) | Yes | Yes (448-bit capacity) |
| Collision resistance | 112 bits | 112 bits | 112 bits |
abc starts with |
23097d22 | 4634270f | e642824c |
All three give the same length and the same collision strength, so the choice comes down to what the other side expects. If a specification just says "224-bit hash", ask which one; they aren't interchangeable.
When SHA3-224 makes sense
Few protocols mandate SHA3-224 specifically. It appears where a design wants SHA-3 for every size in a matrix of options, or where a 28-byte field must hold a SHA-3 digest. The 112-bit collision level is the floor of what NIST allows, and the October 2024 draft of SP 800-131A Rev. 3 proposes a retirement schedule for 224-bit hash functions as the minimum moves to 128 bits. If you can choose freely, the SHA3-256 generator costs four more bytes and lifts collision resistance to 128 bits.
None of the SHA-3 functions are suitable for storing passwords on their own, because they're fast by design. The OWASP Password Storage Cheat Sheet recommends Argon2id, scrypt or bcrypt instead.
Related pages: the SHA-224 generator for the SHA-2 counterpart, the SHAKE128 generator if you need a SHA-3-family output of arbitrary length, and the hash generator for SHA-256 and SHA-512.
Last updated