YoSin Tools

SHAKE128 Hash Generator

Generate SHAKE128 variable-length hashes online. SHAKE128 is an Extendable Output Function (XOF) from NIST FIPS 202, producing any desired number of output bits at 128-bit security level. Configure the output length below.

Input
Output
Share Link
Settings
Hash

Related Hash Tools

SHAKE128 FileHash from file SHAKE256256-bit security XOF cSHAKE128Customizable SHAKE128 SHA3-256Fixed 256-bit SHA-3 SHA256256-bit SHA-2

Frequently Asked Questions

What is SHAKE128?
SHAKE128 is an Extendable Output Function (XOF) from NIST FIPS 202 (2015). It uses the Keccak sponge with 1344-bit rate and 256-bit capacity, providing 128-bit security regardless of how many output bits you request.
Why would I use SHAKE128 instead of SHA-256?
SHAKE128 lets you produce any output length — useful for key derivation, stream ciphers, and protocols needing variable-length pseudorandom output. If you need exactly 256 bits and SHA-2 compatibility, use SHA-256 instead.
What is the minimum output bits for SHAKE128?
The minimum is 8 bits (1 byte). Practical use cases typically use at least 128 or 256 bits. The security level is capped at 128 bits collision resistance regardless of output length.
Does SHAKE128 support HMAC?
Traditional HMAC is defined for hash functions, but XOFs like SHAKE128 are used differently. For keyed authentication with SHAKE128, use KMAC128 (NIST SP 800-185), which is specifically designed for this purpose.

About SHAKE128 Hash Generator

SHAKE128 (Secure Hash Algorithm and Keccak, 128-bit security) is one of two Extendable Output Functions (XOFs) standardized in NIST FIPS 202 (August 2015). Unlike traditional hash functions such as SHA-256 (fixed 256-bit output), SHAKE128 can produce an arbitrary number of output bits by continuing the sponge squeezing phase. This makes it a versatile primitive for key derivation, stream cipher construction, and protocol design.

How SHAKE128 Works

SHAKE128 uses the Keccak sponge with a 1344-bit rate and 256-bit capacity. Input is absorbed in 168-byte blocks. During squeezing, 168 bytes of output are produced per permutation call, and the process continues until the requested number of bits is generated. This allows SHAKE128 to serve as a pseudorandom generator seeded by the input.

Security Level

SHAKE128 provides 128-bit collision resistance and 128-bit preimage security. These security levels hold regardless of how many output bits are requested. If you need 256-bit security (e.g., collision resistance of 2^128), use SHAKE256 instead, which provides 256-bit collision resistance.

Applications

SHAKE128 is used in: post-quantum cryptography schemes (CRYSTALS-Kyber, CRYSTALS-Dilithium use SHAKE for key generation and hashing), key derivation functions (KDFs), masked implementations of cryptographic algorithms, and protocols where variable-length output is needed from a single primitive.

SHAKE128 vs cSHAKE128

cSHAKE128 (customizable SHAKE) is a generalization of SHAKE128 that accepts a function name (N) and customization string (S). When both N and S are empty strings, cSHAKE128 is identical to SHAKE128. For domain-separated usages, use cSHAKE128.