SHA-2 hash generator: the whole family
SHA-2 is a family of six hash functions defined in FIPS 180-4. They share a common design but differ in word size, number of rounds and output length. This SHA-2 hash generator lets you pick any variant from a single menu, so you can compare outputs or match whatever a specification or API asks for.
The variants compared
All digests below are of the standard test input abc:
| Variant | Output | Digest of “abc” (start) |
|---|---|---|
| SHA-224 | 224 bits | 23097d223405d8228642a477… |
| SHA-256 | 256 bits | ba7816bf8f01cfea414140de… |
| SHA-384 | 384 bits | cb00753f45a35e8bb5a03d69… |
| SHA-512 | 512 bits | ddaf35a193617abacc417349… |
| SHA-512/224 | 224 bits | 4634270f707b6a54daae7530… |
| SHA-512/256 | 256 bits | 53048e2681941ef99b2e29b7… |
abc is the example message used in the FIPS 180 standard, so these values double as test vectors. The Variant menu switches between the six SHA-2 members, while the table below the main result also lists hashes from other families for the same input.
Two engines, six outputs
- SHA-256 engine — 32-bit words, 64 rounds, 512-bit blocks. SHA-224 is this engine with different initial values and a truncated output.
- SHA-512 engine — 64-bit words, 80 rounds, 1024-bit blocks. SHA-384, SHA-512/224 and SHA-512/256 each use their own initial values and truncate the output.
Because each truncated variant starts from different initial values, you cannot derive one from another by cutting characters off a longer hash.
Which variant should you use?
| Need | Good choice |
|---|---|
| General purpose, maximum compatibility | SHA-256 |
| Subresource Integrity, TLS with P-384 | SHA-384 |
| Largest output, fast on 64-bit CPUs | SHA-512 |
| 256-bit output, length-extension resistant | SHA-512/256 |
| Specification requires 224 bits | SHA-224 or SHA-512/224 |
Getting the same SHA-2 hash on the command line
The FIPS test value for abc only appears if exactly those three bytes are hashed. The most common reason for a mismatch is an invisible line break:
echo "abc" | sha256sum # hashes "abc\n" → edeaaff3f1774ad2… (different)
printf 'abc' | sha256sum # hashes "abc" → ba7816bf8f01cfea… (matches)Text files have the same issue: a file saved with Windows line endings (CR LF) has different bytes from the same text with Unix line endings, so the hashes differ even though the files look identical. On Windows, PowerShell's Get-FileHash -Algorithm SHA384 file.zip covers SHA-256, SHA-384 and SHA-512; the truncated SHA-512/224 and SHA-512/256 variants need OpenSSL (openssl dgst -sha512-256) or this page.
Security
All SHA-2 variants are considered secure: no practical collision or preimage attacks exist on the full functions. SHA-256 and SHA-512 (but not the truncated variants) are vulnerable to length-extension when misused as secret-prefix MACs — use HMAC for keyed hashing. And no SHA-2 function should be used on its own to store passwords, because they are all designed to be fast; use bcrypt, Argon2id or scrypt.
Verifying results
Command-line equivalents: sha224sum, sha256sum, sha384sum, sha512sum on Linux, or shasum -a 512256 file for SHA-512/256 with Perl’s shasum. Text in this tool is hashed as UTF-8, and files byte for byte. For SHA-3 alternatives, see SHA3-256. Everything runs in your browser.