Comment by alextgordon

> If you can get away with it: use SHA-512/256, which truncates its output and sidesteps length extension attacks.

Note that "SHA-512/256" is a separate algorithm, not to be confused with "SHA-512 or SHA-256" which are two other less secure algorithms.