diff --git a/src/core/crypto/aes_ecb.cpp b/src/core/crypto/aes_ecb.cpp
index 747b0e08d..924256006 100644
--- a/src/core/crypto/aes_ecb.cpp
+++ b/src/core/crypto/aes_ecb.cpp
@@ -36,9 +36,13 @@
 namespace Thread {
 namespace Crypto {
 
-void AesEcb::SetKey(const uint8_t *aKey, uint16_t aKeyLength)
+AesEcb::AesEcb()
 {
     mbedtls_aes_init(&mContext);
+}
+
+void AesEcb::SetKey(const uint8_t *aKey, uint16_t aKeyLength)
+{
     mbedtls_aes_setkey_enc(&mContext, aKey, aKeyLength);
 }
 
@@ -47,5 +51,10 @@ void AesEcb::Encrypt(const uint8_t aInput[kBlockSize], uint8_t aOutput[kBlockSiz
     mbedtls_aes_crypt_ecb(&mContext, MBEDTLS_AES_ENCRYPT, aInput, aOutput);
 }
 
+AesEcb::~AesEcb()
+{
+    mbedtls_aes_free(&mContext);
+}
+
 }  // namespace Crypto
 }  // namespace Thread
diff --git a/src/core/crypto/aes_ecb.hpp b/src/core/crypto/aes_ecb.hpp
index a43e7db0b..3dccb987d 100644
--- a/src/core/crypto/aes_ecb.hpp
+++ b/src/core/crypto/aes_ecb.hpp
@@ -58,6 +58,18 @@ public:
         kBlockSize = 16,  ///< AES-128 block size (bytes).
     };
 
+    /**
+     * Constructor to initialize the mbedtls_aes_context.
+     *
+     */
+    AesEcb();
+
+    /**
+     * Destructor to free the mbedtls_aes_context.
+     *
+     */
+    ~AesEcb();
+
     /**
      * This method sets the key.
      *
diff --git a/src/core/crypto/hmac_sha256.cpp b/src/core/crypto/hmac_sha256.cpp
index 1494a8ad8..2b5f1379e 100644
--- a/src/core/crypto/hmac_sha256.cpp
+++ b/src/core/crypto/hmac_sha256.cpp
@@ -36,12 +36,21 @@
 namespace Thread {
 namespace Crypto {
 
-void HmacSha256::Start(const uint8_t *aKey, uint16_t aKeyLength)
+HmacSha256::HmacSha256()
 {
     const mbedtls_md_info_t *mdInfo = NULL;
     mbedtls_md_init(&mContext);
     mdInfo = mbedtls_md_info_from_type(MBEDTLS_MD_SHA256);
     mbedtls_md_setup(&mContext, mdInfo, 1);
+}
+
+HmacSha256::~HmacSha256()
+{
+    mbedtls_md_free(&mContext);
+}
+
+void HmacSha256::Start(const uint8_t *aKey, uint16_t aKeyLength)
+{
     mbedtls_md_hmac_starts(&mContext, aKey, aKeyLength);
 }
 
@@ -53,7 +62,6 @@ void HmacSha256::Update(const uint8_t *aBuf, uint16_t aBufLength)
 void HmacSha256::Finish(uint8_t aHash[kHashSize])
 {
     mbedtls_md_hmac_finish(&mContext, aHash);
-    mbedtls_md_free(&mContext);
 }
 
 }  // namespace Crypto
diff --git a/src/core/crypto/hmac_sha256.hpp b/src/core/crypto/hmac_sha256.hpp
index 3494a6f36..c0c0947c7 100644
--- a/src/core/crypto/hmac_sha256.hpp
+++ b/src/core/crypto/hmac_sha256.hpp
@@ -60,6 +60,18 @@ public:
         kHashSize = 32,  ///< SHA-256 hash size (bytes)
     };
 
+    /**
+     * Constructor for initialization of mbedtls_md_context_t.
+     *
+     */
+    HmacSha256();
+
+    /**
+     * Destructor for freeing of mbedtls_md_context_t.
+     *
+     */
+    ~HmacSha256();
+
     /**
      * This method sets the key.
      *
diff --git a/src/core/crypto/sha256.cpp b/src/core/crypto/sha256.cpp
index 0e7441aee..ba7f28ee7 100644
--- a/src/core/crypto/sha256.cpp
+++ b/src/core/crypto/sha256.cpp
@@ -36,9 +36,18 @@
 namespace Thread {
 namespace Crypto {
 
-void Sha256::Start(void)
+Sha256::Sha256()
 {
     mbedtls_sha256_init(&mContext);
+}
+
+Sha256::~Sha256()
+{
+    mbedtls_sha256_free(&mContext);
+}
+
+void Sha256::Start(void)
+{
     mbedtls_sha256_starts(&mContext, 0);
 }
 
@@ -50,7 +59,6 @@ void Sha256::Update(const uint8_t *aBuf, uint16_t aBufLength)
 void Sha256::Finish(uint8_t aHash[kHashSize])
 {
     mbedtls_sha256_finish(&mContext, aHash);
-    mbedtls_sha256_free(&mContext);
 }
 
 }  // namespace Crypto
diff --git a/src/core/crypto/sha256.hpp b/src/core/crypto/sha256.hpp
index 666645aa6..732fd8bb2 100644
--- a/src/core/crypto/sha256.hpp
+++ b/src/core/crypto/sha256.hpp
@@ -60,6 +60,18 @@ public:
         kHashSize = 32,  ///< SHA-256 hash size (bytes)
     };
 
+    /**
+     * Constructor for initializing mbedtls_sha256_context.
+     *
+     */
+    Sha256();
+
+    /**
+     * Destructor for freeing mbedtls_sha256_context.
+     *
+     */
+    ~Sha256();
+
     /**
      * This method starts the SHA-256 computation.
      *