SHAKE256 hash generator
SHAKE256 is the stronger of the two extendable-output functions in FIPS 202. It offers up to 256 bits of security and produces as much output as you request. The SHAKE256 generator defaults to 512 bits — the length at which it reaches full 256-bit collision resistance — and accepts any multiple of 8 from 8 to 8192.
Example
Input:
The quick brown fox jumps over the lazy dogSHAKE256, 512-bit output:
2f671343d9b2e1604dc9dcf0753e5fe15c7c64a0d283cbbf722d411a0e36f6ca1d01d1369a23539cd80f7c054b6e5daf9c962cad5b8ed5bd11998b40d5734442At a glance
| Property | Value |
|---|---|
| Output length | Any; this tool supports 8–8192 bits |
| Rate / capacity | 1088 / 512 bits |
| Security | Up to 256 bits |
| Standard | FIPS 202 (2015) |
SHAKE256 absorbs data at the same rate as SHA3-256, so it runs at the same speed; only the output stage differs.
Because the output is a stream, you can also treat SHAKE256 as a deterministic generator: the same input and length always give the same bytes, which is useful for reproducible test data.
Output length and security
| Output length | Collision resistance | Preimage resistance |
|---|---|---|
| 256 bits | 128 bits | 256 bits |
| 512 bits | 256 bits | 256 bits |
| 1024 bits | 256 bits | 256 bits |
Longer output is useful when you need more key material, but it does not raise security beyond 256 bits.
Where SHAKE256 is used
- The Ed448 signature scheme (RFC 8032) uses SHAKE256 internally.
- Post-quantum standards such as ML-DSA and SLH-DSA use SHAKE256 for hashing and randomness expansion.
- Key derivation and domain-separated hashing in modern protocols, often via cSHAKE or KMAC, which are built on the same function.
Related NIST functions
NIST SP 800-185 builds several functions on the same sponge: cSHAKE adds a customisation string for domain separation, KMAC turns it into a keyed MAC, and TupleHash and ParallelHash hash structured or very large inputs. If a protocol asks for one of these, plain SHAKE256 will not produce the same output, even though the core permutation is identical.
Using it elsewhere
Python: hashlib.shake_256(data).hexdigest(64) for 512 bits (length in bytes). OpenSSL 3: openssl dgst -shake256 -xoflen 64 file. Remember that SHAKE outputs are prefixes of each other, so a 256-bit SHAKE256 value equals the first half of the 512-bit one.
Compare with SHAKE128 for 128-bit security, or with BLAKE3, another extendable-output hash. SHAKE256 is not a password hash. Everything runs in your browser.
Bits here, bytes elsewhere
The most common reason a SHAKE256 value does not match is a unit mix-up. This tool asks for the output length in bits, while most libraries and command-line tools take bytes:
- Python
hexdigest(32)means 32 bytes, which is 256 bits here. - OpenSSL
-xoflen 32also means 32 bytes. - Node.js
createHash('shake256', { outputLength: 32 })is bytes as well.
Because shorter outputs are prefixes of longer ones, a mix-up often looks like a partial match: one value is simply the beginning of the other. To check an implementation, hash an empty input with 256 bits of output; the result starts with 46b9dd2b0ba88d13.