Generate SHA-3 family hashes using Keccak sponge construction. Variable-length SHAKE-256/128 XOF output for key derivation, PRNG, and domain-separated hashing.
Generating a SHA-3 family hash is simple: Type or paste your text into the input box, or upload a file if you need to compute its hash digest. Select the SHA-3 variant you need from the dropdown menu. SHA3-256 is the direct replacement for SHA-256. SHA3-512 replaces SHA-512. SHAKE-128 and SHAKE-256 are extendable-output functions — specify your desired output length and get a hash of exactly that size. Click Generate to compute the hash. The result appears instantly in the output box as a hexadecimal string. Copy it and use it wherever needed — whether that's generating deterministic random numbers with SHAKE, creating unique identifiers, or implementing post-quantum-ready hashing.
SHA-3 is based on Keccak, the winner of the NIST hash function competition (2008-2012). Unlike SHA-2 which uses the Merkle-Damgård construction (the same structure as MD5 and SHA-1), SHA-3 uses the sponge construction. The sponge operates in two phases: absorb and squeeze. During absorption, input blocks are XORed into a state array and permuted. During squeezing, output is read from the state. The Keccak permutation uses a round function based on bitwise operations (θ, ρ, π, χ, ι) applied to a 1600-bit state arranged as a 3D array of 64-bit lanes. This design makes SHA-3 fundamentally resistant to the length-extension attacks that affect SHA-2. With SHA-2, appending data to a hashed message produces a predictable new hash — with SHA-3, this is impossible without knowing the internal state. The sponge construction also naturally supports variable-length output, which is why SHAKE-128 and SHAKE-256 exist as part of the SHA-3 family.
NIST selected Keccak as SHA-3 precisely because SHA-2 and SHA-1 share the same Merkle-Damgård construction. If a fundamental weakness were discovered in that construction, both families would be vulnerable simultaneously. SHA-3's sponge construction provides architectural diversity — a break in Merkle-Damgård wouldn't affect SHA-3. In practice, SHA-2 remains secure today, but having SHA-3 as a fallback is prudent for long-term systems. Ethereum 2.0 (now Ethereum) adopted Keccak-256 (not NIST-standardized SHA3-256) as its primary hash function. Cardano uses SHA-3-256 for address generation. The National Institute of Standards and Technology recommends SHA-3 for new designs in SP 800-56C Rev. 2, particularly where resistance to length-extension attacks is valuable. For most applications, SHA-256 and SHA3-256 are interchangeable from a security standpoint — choose based on ecosystem requirements.
SHAKE-128 and SHAKE-256 are XOFs (Extendable-Output Functions) — unlike fixed-output SHA-3 variants, they can produce arbitrarily long outputs. You request N bits and get exactly N bits of pseudorandom output. This makes them useful as deterministic random number generators, key derivation functions, and authenticated encryption components. NIST SP 800-56C recommends SHAKE-128 and SHAKE-256 for key derivation, replacing the older HKDF constructions in many cases. In practice, developers use SHAKE-256 to derive encryption keys from passwords (combined with a salt), generate deterministic nonces for cryptographic protocols, or create proof-of-stake randomness beacons. The security strength of SHAKE-128(n) is min(n/2, 128) bits, and SHAKE-256(n) is min(n/2, 256) bits — meaning SHAKE-256-512 provides 256-bit security despite producing 512 bits of output.
They use the same underlying Keccak permutation but differ in padding. NIST standardized SHA-3 with a different domain separation pad (0x06) compared to original Keccak (0x01). Ethereum uses original Keccak-256, while NIST SHA3-256 produces different output for the same input. Always verify which variant your target system expects.
Use SHAKE when you need a variable-length output — for key derivation, deterministic random number generation, or when your protocol specifies a particular output length that doesn't match SHA3-224/256/384/512. For fixed-length hashing, SHA3-256 is simpler and more widely recognized.
Both are considered secure. SHA-3 offers architectural diversity (sponge vs Merkle-Damgård), which is valuable for defense-in-depth. Neither has known practical attacks. Choose SHA-3 when you want construction diversity or need XOF capabilities. Choose SHA-2 for broader ecosystem support and familiarity.
Ethereum was developed before NIST finalized SHA-3 in 2015. The team had already committed to Keccak and saw no reason to switch. The padding difference between Keccak and NIST SHA-3 is the only distinction — both use the same permutation function and offer equivalent security.
No — SHAKE produces pseudorandom output deterministically from its seed input. It's cryptographically unpredictable (given SHAKE-256's security properties), but given the same seed, it always produces the same output. For cryptographic randomness, combine SHAKE with a high-entropy seed from your OS's CSPRNG (/dev/urandom or CryptGenRandom).
The sponge construction absorbs all input before producing any output. Unlike Merkle-Damgård where the intermediate state is exposed as the hash output, SHA-3's internal state is never fully revealed. After absorbing input, the remaining state is permuted and squeezed — there's no way to continue absorbing additional data without knowing the full internal state.
SHAKE supports any output length from 1 bit up to 2^136 - 1 bits. In practice, you'd use 256, 384, or 512 bits for most cryptographic purposes. Specify your desired length in bytes when calling the SHAKE function.