SHA224 Hash Generator

SHA-224 shares SHA-256's compression function, starts from a different IV, then throws the last word away. Hash text or a file, read the seven published registers plus the discarded eighth, and watch a sliced SHA-256 digest fail to match.

SHA-224 digest bench

Keeping the first 56 hex characters of a SHA-256 digest is not SHA-224. The trap row under the registers prints both strings for the same input. They disagree on the first byte.

0 UTF-8 bytes
FIPS vectors
Hash a file insteadRead in this tab. Never uploaded. Past about 48 MB, use openssl dgst -sha224.

Empty input still has a digest. FIPS 180-4 publishes it.

Eight 32-bit words after the last round
h0········
h1········
h2········
h3········
h4········
h5········
h6········
h7 dropped········

h0 through h6 are the published 224-bit digest. h7 is computed, then discarded. Copy never includes it.

Waiting for a hash
Input0 bytes
Digest28 bytes · 56 hex
512-bit blocks1

Same width. Different hash.

Waiting
SHA-224 (this page)
First 56 hex of SHA-256

Hash something to see the two 56-character strings sit next to each other. A prefix match never happens.

crypto.subtle.digest throws if you ask for SHA-224

Open the console on this page and run:

await crypto.subtle.digest('SHA-224', new Uint8Array())

Chrome, Firefox, and Safari reject the call. The Web Cryptography API names SHA-1, SHA-256, SHA-384, and SHA-512. SHA-224 never made the list.

Node accepts crypto.createHash('sha224'). OpenSSL accepts openssl dgst -sha224. Java MessageDigest.getInstance("SHA-224") works. The browser is the odd one out, and that gap is where the bad shortcut is born.

A frontend already hashing SHA-256 through Web Crypto keeps the first 56 hex characters and labels the result SHA-224. The label is a lie. The number is a different hash. The trap row on the bench prints both strings for one input so the mismatch is visible, not a footnote in FIPS 180-4.

This page runs SHA-224 in the tab, in JavaScript, because the platform API refuses. Files are read with FileReader. Nothing is uploaded. Load the page once, cut the connection, keep hashing.

Seven words leave the function. Eight words ran inside it.

SHA-224 is not a smaller cousin with a smaller engine. It is the SHA-256 compression function wearing a different start state.

512-bit blocks. 64 rounds. Eight 32-bit registers. FIPS 180-4 seeds those registers from the 32 high bits of the fractional parts of the square roots of primes 23 through 53, which is a long way of saying the IV is not the SHA-256 IV. After the last round the engine still holds 256 bits. The published digest is the first 224. The eighth word is computed, then thrown away.

Initial hash values. Same engine, different start, so every round differs.
RegisterSHA-224 IVSHA-256 IV
h0c1059ed86a09e667
h1367cd507bb67ae85
h23070dd173c6ef372
h3f70e5939a54ff53a
h4ffc00b31510e527f
h5685815119b05688c
h664f98fa71f83d9ab
h7befa4fa45be0cd19

The register strip on the bench follows those eight names. h0 through h6 concatenate into the 56 hex characters you copy. h7 sits in the copper cell labelled dropped. Copy never includes it. Treating the dropped word as optional output is how two implementations drift.

Press abc on the vector row. The seven published words read 23097d22, 3405d822, 8642a477, bda255b3, 2aadbce4, bda0b3f7, e36c9da7. FIPS 180-4 prints that exact string. A mismatch on the first official test case means the implementation is broken. Stop there.

Cutting SHA-256 to 56 characters is a different hash

People expect a prefix. They never get one.

Because the start state differed, every round differed, so the surviving 224 bits share no leading bytes with SHA-256 of the same input. Look at the first byte of the empty-string pair. Already different.

FIPS vectors versus the first 56 hex characters of SHA-256. No row agrees.
InputSHA-224SHA-256 sliced to 56 hex
empty stringd14a028c2a3a2bc9…e42fe3b0c44298fc1c14…991b
abc23097d223405d822…9da7ba7816bf8f01cfea…ff61
toolexe.com744cd11038d00918…cbf9a different 56 characters again

I have watched a payment callback fail for a week because one vendor called SHA-224 and the other truncated SHA-256, both ticking a box labelled SHA-2. The shared 56-character width hid the bug. Width is not identity. The SHA-2 family board is the place to see all four members at once. This page exists for the one mix-up those 56 characters keep causing.

Holding 56 hex characters from a vendor right now. Paste them into the check field on the bench. A match against the truncated SHA-256 row means the publisher hashed the wrong function. Re-downloading the file will not fix a wrong algorithm.

Collision work sits near 2112. Skip this width on new work.

A birthday attack against a 224-bit digest costs about 2112 operations. NIST's current floor for collision resistance on new federal systems is 128 bits. SHA-224 misses it.

TLS 1.3 does not name SHA-224. Public certificate chains moved off it years ago. CNSA 1.0 pairs AES-256 with SHA-384, not with this member. Browser Web Crypto omitted it on purpose.

For new work the defaults are boring on purpose. SHA-256 unless a profile names another member. SHA-384 if a government checklist is on the desk. SHA-512/256 if you want 256 bits from the 64-bit engine without publishing the full internal state. All three beat 224 bits on the only metric that matters for a new hash: collision work.

Two other hashes also print 56 hex characters

A 56-character string is not a fingerprint of SHA-224.

SHA-512/224 runs the 64-bit SHA-512 engine with its own IV, then keeps 224 bits. Same width. Different number. Faster on 64-bit hardware, which is why some teams reach for it and then paste the result into a SHA-224 field.

SHA3-224 belongs to Keccak. Sponge construction, different padding, different everything. Same width again.

Count the characters, then name the family from context. A CMS blob from 2012 is usually SHA-224. A SHA-3 migration is usually SHA3-224. Guessing from width alone is how two 56-character strings sit in a ticket for three days while both sides insist the file is fine.

Throwing a word away closes length extension. HMAC still belongs on keyed data.

SHA-256 publishes its entire internal state as the digest. Anyone holding hash(secret || message) resumes the compression function and forges a valid digest for a longer message, without the secret. SHA-224 throws 32 bits of state away, so the published digest is not enough to resume. SHA-384 does the same trick on the 64-bit engine.

A narrow win. Not a substitute for a keyed construction.

Request signatures, webhook tags, and API auth still want HMAC. The HMAC generator on this site takes SHA-256 or SHA-512. SHA-224 as an HMAC inner hash shows up in old CMS signed attributes. A new integration has no reason to start there.

Password storage is a different refusal. SHA-224 is fast. Fast helps a GPU working through a leaked table. Argon2id, scrypt, or bcrypt belong there. Hashing a password on this bench will not reproduce a shadow entry, a WordPress $P$ hash, or any stretched construction.

What this page will not do

Line endings are hashed as they arrive. CRLF versus LF rewrites every word on the strip. echo appends a newline. printf does not. The byte counter above the bench is the first place to look when a terminal disagrees with this page.

printf %s abc | openssl dgst -sha224 # 23097d223405d8228642a477bda255b32aadbce4bda0b3f7e36c9da7 echo abc | openssl dgst -sha224 # a different digest, because echo added a newline openssl dgst -sha224 release.tar.gz sha224sum release.tar.gz

Empty-string SHA-224 is d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f. If the hex row disagrees on an empty box, stop and check the browser.

56-character checksums pasted into the wrong box

Why does crypto.subtle.digest('SHA-224') fail in the browser?

The Web Cryptography API never listed SHA-224. Chrome, Firefox, and Safari support SHA-1, SHA-256, SHA-384, and SHA-512. Node crypto.createHash('sha224') and openssl dgst -sha224 both work. This page hashes SHA-224 in JavaScript inside the tab for that reason, not because a server round trip is involved.

Why is SHA-224 not the first 56 characters of SHA-256?

SHA-224 starts from a different set of initial values in FIPS 180-4, then drops 32 bits after the rounds finish. Because the start state differed, every round differed. Slicing a SHA-256 digest produces a different 56-character string. The trap row on this page prints both for the same input. The first byte already disagrees.

My 56-character checksum does not match. Is the file corrupt?

Check the algorithm before you re-download. Paste the value into the check field. If it matches the truncated SHA-256 row, the publisher hashed SHA-256 and kept 56 characters. If the width is 56 but neither row matches, the other common functions at this width are SHA-512/224 and SHA3-224. A trailing newline on one side, or CRLF versus LF, also rewrites the whole digest.

Should a new API pick SHA-224?

No. Collision resistance sits near 2^112, under the 128-bit floor most teams now treat as the minimum. TLS 1.3 does not name it. Web Crypto omits it. Pick SHA-256 unless a profile names another member. Pick SHA-384 if a government checklist or CNSA 1.0 is in play. Keep SHA-224 for reading old CMS messages, HSM output, and checksum files that already use it.

What is the dropped word on the register strip?

SHA-224 runs eight 32-bit registers, the same width as SHA-256. After the last round the engine holds 256 bits. The published digest is the first seven words, 224 bits, 56 hex characters. The eighth word is computed and discarded. Copy never includes it. Two implementations that disagree on whether to print that word are not both SHA-224.

SHA-224, SHA-512/224, and SHA3-224 all look 56 characters long. How do I tell them apart?

Width does not name the function. SHA-224 uses the 32-bit SHA-256 engine with its own IV. SHA-512/224 uses the 64-bit SHA-512 engine with a different IV. SHA3-224 is Keccak. Hash the same input on each dedicated page. Only one row will match a published checksum. A CMS blob from around 2012 is usually SHA-224. A SHA-3 migration is usually SHA3-224.

Does truncation mean SHA-224 is safe from length extension?

The published digest is no longer the full internal state, so the classic length-extension resume against SHA-256 does not apply. That is a narrow property. Request signatures and webhook tags still want HMAC. Password storage still wants Argon2id, scrypt, or bcrypt. Do not treat truncation as a keyed construction.

Are text and files sent to a server?

No. SHA-224 runs in JavaScript in the tab because Web Crypto omits it. SHA-256 for the trap row uses the same local hasher. Files are read with FileReader. There is no upload step. Load the page once and it keeps working with the connection cut.

The digest here disagrees with openssl dgst -sha224 on my machine.

Nine times out of ten a trailing newline is in one side and missing from the other. echo abc feeds four bytes. printf %s abc feeds three. Windows CRLF versus Unix LF rewrites every register for the same looking text. A UTF-8 byte order mark at the start of a saved file does the same. The byte counter above the bench is the first place to look.