What is SHA-224?
SHA-224 is a 224-bit cryptographic hash function defined in NIST FIPS 180-2 (2001), alongside SHA-256, SHA-384, and SHA-512. It takes input of any length and produces a fixed 224-bit digest — twenty-eight bytes, conventionally written as fifty-six hexadecimal characters.
The defining trait of the SHA-2 family is that all members share the same underlying machinery: SHA-224 is the same 512-bit-block, 64-round compression function as SHA-256. Only two things change. First, the initial chaining values (IVs) are derived from the fractional parts of the cube roots of the first primes, and differ from SHA-256's — this deliberately decouples the outputs so a truncated SHA-256 value cannot be confused with a real SHA-224 value. Second, the final state is cut from 256 to 224 bits, discarding the last 32 bits.
SHA-224 vs SHA-256
| SHA-224 | SHA-256 | |
|---|---|---|
| Digest length | 224 bits (28 bytes / 56 hex) | 256 bits (32 bytes / 64 hex) |
| Block size | 512 bits | 512 bits |
| Rounds | 64 | 64 |
| Collision resistance | 112-bit (birthday bound) | 128-bit (birthday bound) |
| Throughput | Identical to SHA-256 | Reference for the family |
| Web Crypto native? | No — WASM here | Yes |
Because the workload is identical, SHA-224 is exactly as fast as SHA-256. The only real difference is the 32-bit output reduction, which halves the storage bill for mass-hashed data sets and matches protocols that demand a 28-byte value.
Security level
SHA-224 was designed so AES-128-compatible security takes about 2112 work to break by collision — comfortably beyond any foreseeable computing power. The truncation intentionally matches the security target of 112 bits (the level the community attributes to 3DES and SHA-224's legacy contexts). No practical preimage, second-preimage, or collision attack on SHA-224 has ever been published.
Where SHA-224 is used
- TLS and IPsec. Early TLS 1.2 ciphersuites and IPsec key exchange reference SHA-224 in their PRF and integrity suites.
- Key derivation. Several KDF designs and FIPS-approved constructions use SHA-224 where a 28-byte output is mandated.
- Legacy interop. System
sha224sumand embedded stacks that already emit it; matching them locally is the honest way to interoperate.
For new cryptographic systems the default recommendation remains SHA-256 — marginally stronger, universally supported. Reach for SHA-224 when a protocol or storage constraint explicitly asks for the shorter length.
How this tool works
The Web Crypto API does not expose SHA-224, so this page computes it with the
hash-wasm WebAssembly build of the reference implementation. The WASM module is
fetched once and reused for every digest, so after the first computation hashing is effectively
instant. Input is converted to bytes locally (UTF-8, hex, or Base64), hashed on-device, and never
leaves your machine.
Worked examples you can verify right now
| Input | SHA-224 digest |
|---|---|
(empty string) | d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f |
hello world | 2f05477fc24bb4faefd86517156dafdecec45b8ad3cf2522a563582b |
The quick brown fox jumps over the lazy dog | 730e109bd7a8a32b1cb9d9a09aa2325d2430587ddbc0c38bad911525 |
Re-type any row above in the tool (matching UTF-8 exactly, including the trailing period in the fox sentence) and you will get precisely these 56-character digests.