What is SHA-512/224?
SHA-512/224 is a SHA-2 hash function that runs the full SHA-512 algorithm from its own distinct starting values, then keeps only the leftmost 224 bits of the result. You get a 56-character hex digest, the same length as SHA-224, but computed with 64-bit words and 80 rounds. It was added to the Secure Hash Standard in 2012.
The name reads as "SHA-512 truncated to 224 bits", and that reading causes most of the confusion around it. The truncation is real, but the starting point is different too, which is why the output doesn't match anything you can get from a plain SHA-512 hash.
Where the starting values come from
Most hash functions hard-code their initial hash value. FIPS 180-4 section 5.3.6 instead defines a small procedure for any SHA-512/t, and this tool follows it exactly rather than storing constants:
- Take SHA-512's eight 64-bit initial words.
- XOR each with
a5a5a5a5a5a5a5a5. - Using those modified words as the starting state, hash the ASCII string
SHA-512/224. - The resulting eight words become the initial hash value for SHA-512/224.
Hashing your text then works like SHA-512: 128-byte blocks, 80 rounds, eight 64-bit state words. At the end, 224 bits is three and a half words, so the digest is the first three words plus the top half of the fourth.
Three 56-character results for one input
Here's the input abc through three functions that all produce 224 bits:
SHA-512/224("abc") 4634270f707b6a54daae7530460842e20e37ed265ceee9a43e8924aa
SHA-224("abc") 23097d223405d8228642a477bda255b32aadbce4bda0b3f7e36c9da7
SHA-512("abc") cut to 56 ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee6
The first line is the published test value for SHA-512/224 and is what this page returns. If a library gives you the third line, it isn't implementing SHA-512/224. Another reference value: hello world gives 22e0d52336f64a998085078b05a6e37b26f8120f43bf4db4c43a64ee.
How it compares
| Property | SHA-224 | SHA-512/224 |
|---|---|---|
| Underlying engine | SHA-256 (32-bit words, 64 rounds) | SHA-512 (64-bit words, 80 rounds) |
| Block size | 64 bytes | 128 bytes |
| Internal state | 256 bits | 512 bits |
| State bits hidden by truncation | 32 | 288 |
| Collision resistance | 112 bits | 112 bits |
| Built into Web Crypto | No | No |
The two are equal on collision resistance because that depends on output length, as NIST's table in SP 800-107 Rev. 1 shows. Where they differ is length extension. An attacker who wants to append data to a hashed message needs the full internal state. SHA-224 leaves only 32 bits to guess; SHA-512/224 hides 288, which puts the attack out of reach.
Using this generator
Type or paste text and click Generate. The text is UTF-8 encoded with nothing trimmed, the output is lowercase hex, and an empty box returns nothing. To verify on the command line:
printf '%s' 'abc' | openssl dgst -sha512-224
OpenSSL 1.1.1 and later support it.
Should you pick it?
Honestly, rarely. SHA-512/224 appears mostly in standards that enumerate every approved hash and in test suites. It shares SHA-224's 112-bit security level, and the October 2024 draft of SP 800-131A Rev. 3 proposes a retirement schedule for 224-bit hash functions as NIST moves to a 128-bit minimum.
If you like its design properties, take the 256-bit sibling, the SHA-512/256 generator, which has the same length-extension resistance with 128-bit strength. If you need to match a 56-character value from a 32-bit design, use the SHA-224 generator. For everyday checksums, the hash generator covers SHA-256, SHA-384 and SHA-512, and to authenticate data with a key use the HMAC generator.
Last updated