SHAKE128: a hash with adjustable length
SHAKE128 is an extendable-output function (XOF) defined in FIPS 202 alongside the SHA-3 hashes. Instead of a fixed digest, it can squeeze out as many bits as you ask for. This SHAKE128 generator lets you choose any length that is a multiple of 8 bits, from 8 to 8192, and computes it for text or files.
Example
Input:
The quick brown fox jumps over the lazy dogSHAKE128, 256-bit output:
f4202e3c5852f9182a0430fd8144f0a74b95e7417ecae17db0f8cfeed0e3e66eWith the output length set to 128 bits the result is f4202e3c5852f9182a0430fd8144f0a7 — exactly the first half of the 256-bit output. Shorter SHAKE outputs are always prefixes of longer ones, which is a defining property of XOFs.
At a glance
| Property | Value |
|---|---|
| Output length | Any; this tool supports 8–8192 bits |
| Rate / capacity | 1344 / 256 bits of the 1600-bit Keccak state |
| Security | Up to 128 bits (collision resistance is limited to half the output length) |
| Standard | FIPS 202 (2015) |
Choosing the output length
Security is the smaller of 128 bits and what the output length allows. For collision resistance, you need at least 256 bits of output to reach the full 128-bit level; a 128-bit output only gives 64-bit collision resistance. For preimage resistance or key derivation, 128 bits of output already give 128-bit security. Using more than 256 bits of output never increases SHAKE128’s security beyond 128 bits — it just gives you more material.
For the empty input, SHAKE128 with 256 bits of output begins 7f9c2ba4e88f827d… — a quick check that an implementation uses the correct SHAKE padding.
Where SHAKE128 is used
- Post-quantum cryptography: ML-KEM (Kyber) and ML-DSA (Dilithium) use SHAKE128 to expand seeds into matrices.
- Deriving several keys or a long stream of pseudorandom bytes from one input.
- Protocols that need a hash output of a non-standard length without ad-hoc truncation.
Things to know
- SHAKE128 is not the same as SHA3-256, even at 256 bits of output; the domain separation differs.
- For 256-bit security, use SHAKE256.
- In code: Python
hashlib.shake_128(data).hexdigest(32)(length in bytes), OpenSSLopenssl dgst -shake128 -xoflen 32.
Like other fast hash functions, SHAKE128 is not suitable for storing passwords. The computation runs locally in your browser.