What is SHAKE128?
SHAKE128 is an extendable-output function (XOF) from the SHA-3 standard, FIPS 202. Like a hash, it digests any input deterministically; unlike a hash, you choose how many output bytes you want. It targets the 128-bit security level. This tool lets you pick 1 to 128 bytes, defaulting to 32, and prints the result as lowercase hex.
Internally SHAKE128 uses the same Keccak-f[1600] permutation as SHA3-256, but with a 256-bit capacity instead of 512, so it absorbs and squeezes 168 bytes per permutation. That makes it the fastest function in the SHA-3 standard.
Using the length slider
- Paste or type your text. It's encoded as UTF-8, exactly as entered.
- Drag Output length (bytes) to the size you need. The number beside the label is bytes; the hex output will be twice as many characters.
- Click Generate. Moving the slider alone doesn't refresh the result, so click again after changing it.
- Copy the hex string. An empty input box produces no output.
Since 168 bytes fit in one squeeze, every length this tool offers comes from a single permutation output after absorbing your text.
One input, several lengths
The useful property of an XOF is that it produces a single stream. Asking for more bytes just reads further along it:
SHAKE128("abc", 16 bytes) 5881092dd818bf5cf8a3ddb793fbcba7
SHAKE128("abc", 32 bytes) 5881092dd818bf5cf8a3ddb793fbcba74097d5c526a6d35f97b83351940f2cc8
SHAKE128("abc", 64 bytes) 5881092dd818bf5cf8a3ddb793fbcba74097d5c526a6d35f97b83351940f2cc844c50af32acd3f2cdd066568706f509bc1bdde58295dae3f891a9a0fca578378
These match Node.js crypto.createHash('shake128', { outputLength: n }) byte for byte. The prefix behaviour has a practical consequence: if two parts of a system both use SHAKE128 on the same input with different lengths, the shorter value is fully revealed by the longer one. Separate them by putting a distinct label in the input, or use cSHAKE128 from NIST SP 800-185, which adds a customization string for exactly this purpose.
How much output is enough?
FIPS 202 caps SHAKE128 at 128-bit security however long the output is, and short outputs reduce it further. For an output of d bits, collision resistance is the smaller of d/2 and 128 bits.
| Output length | Hex characters | Collision resistance | Typical fit |
|---|---|---|---|
| 1 byte | 2 | 4 bits | Demonstrations only |
| 8 bytes | 16 | 32 bits | Non-security bucketing |
| 16 bytes | 32 | 64 bits | OpenSSL and Node default; weak against collisions |
| 32 bytes | 64 | 128 bits | Full strength, this tool's default |
| 64 to 128 bytes | 128 to 256 | 128 bits | When a protocol needs more key material |
Past 32 bytes you get more output, not more security. If you need 256-bit strength, use SHAKE256 instead of just stretching SHAKE128.
Where SHAKE128 is used
The most prominent current use is post-quantum cryptography. ML-KEM (FIPS 203) uses SHAKE128 as its XOF, reading a long stream from it to generate the public matrix from a 32-byte seed. ML-DSA, the lattice signature scheme in FIPS 204, also relies on both SHAKE functions. In both, the variable output length is the point: one call expands a short seed into as many pseudorandom bytes as the algorithm needs.
Those standards feed binary seeds into SHAKE, often several bytes at a time with indexes appended. This tool only accepts text, so it's good for checking how SHAKE behaves and for matching text-based test values, not for reproducing ML-KEM intermediate results.
What it doesn't do
SHAKE128 is deterministic and keyless. It can't encrypt, it can't be reversed, and it shouldn't be used directly to hash passwords, since it's very fast; the OWASP Password Storage Cheat Sheet covers the slow functions to use instead. For random keys or tokens, draw from a random source such as the random byte generator rather than hashing something guessable. For a conventional fixed-length digest from the same family, use the SHA3-256 generator, and for SHA-256 the hash generator.
Last updated