YoSin Tools

SHAKE256 Hash Generator

Generate SHAKE256 variable-length hashes online. SHAKE256 is an Extendable Output Function (XOF) from NIST FIPS 202, providing 256-bit security. Used in NIST post-quantum cryptography standards. Configure output length below.

Input
Output
Share Link
Settings
Hash

Related Hash Tools

SHAKE256 FileHash from file SHAKE128128-bit security XOF cSHAKE256Customizable SHAKE256 KMAC256Keyed MAC from SHAKE256 SHA3-256Fixed 256-bit SHA-3

Frequently Asked Questions

What is SHAKE256?
SHAKE256 is an Extendable Output Function from NIST FIPS 202. It uses the Keccak sponge with a 1088-bit rate and 512-bit capacity, providing 256-bit security and producing any desired number of output bits.
How is SHAKE256 used in post-quantum cryptography?
SHAKE256 is a core component of NIST post-quantum standards: ML-KEM (Module-Lattice Key Encapsulation), ML-DSA (Module-Lattice Digital Signatures), and SLH-DSA (Stateless Hash-Based Signatures). It is used for key generation, hashing, and pseudorandom generation within these schemes.
Can I use SHAKE256 for password hashing?
SHAKE256 alone is not suitable for password hashing, as it is fast and has no cost-tuning mechanism. For password hashing, use purpose-built algorithms like Argon2, bcrypt, or scrypt. SHAKE256 can be a component in a broader KDF but not as a direct password hash.
SHAKE256 vs SHA3-512 — which is better?
If you need exactly 512 bits, SHA3-512 is the standardized choice. SHAKE256 is preferred when you need variable output length or are building a system that requires arbitrary-length pseudorandom output from NIST-approved primitives.

About SHAKE256 Hash Generator

SHAKE256 is the higher-security Extendable Output Function (XOF) from NIST FIPS 202 (August 2015). It uses the Keccak sponge with a 1088-bit rate and 512-bit capacity, providing 256-bit security. The squeezing phase can be continued indefinitely to produce as many output bits as needed, making SHAKE256 a versatile building block for modern cryptographic systems.

256-bit Security XOF

SHAKE256's 512-bit capacity provides collision resistance of 2^256 and preimage resistance of 2^256. This exceeds the security level of SHA-256 in terms of collision resistance (SHA-256 has 128-bit collision resistance). SHAKE256 is appropriate for applications requiring long-term security and quantum-resilient designs.

Post-Quantum Cryptography

SHAKE256 is embedded in the core of NIST's finalized post-quantum algorithms. ML-KEM (FIPS 203) uses SHAKE256 for key generation and encapsulation. ML-DSA (FIPS 204) uses SHAKE256 for hashing within the signing and verification algorithms. SLH-DSA (FIPS 205) uses SHAKE256 as its underlying hash function. These standards will secure communications well beyond the era of quantum computers.

cSHAKE256 and KMAC256

SHAKE256 is the basis for cSHAKE256 (customizable SHAKE, NIST SP 800-185) which adds domain separation via function name and customization strings. KMAC256 is a keyed MAC built on cSHAKE256. When cSHAKE256 is called with empty N and S, it degenerates to SHAKE256.