What does a SHAKE256 generator do?
A SHAKE256 generator runs text through SHAKE256, the 256-bit-security extendable-output function from FIPS 202, and returns as many bytes as you ask for. Here that's 1 to 128 bytes, defaulting to 32, shown as lowercase hex. Same input and length always give the same output, and a shorter output is always a prefix of a longer one.
Under the hood SHAKE256 shares its rate and capacity with SHA3-256: 136 bytes absorbed per Keccak-f[1600] permutation, 512 bits of hidden capacity. The difference is in the padding (0x1f instead of 0x06 in the code) and in squeezing out a caller-chosen number of bytes instead of a fixed 32.
Reading the output
With the default 32-byte length, abc gives:
483366601360a8771c6863080cc4114d8db44530f8f1e1ee4f94ea37e78b5739
That's identical to openssl dgst -shake256 and to Node's crypto.createHash('shake256'), both of which default to 32 bytes. Set the slider to 64 and the first 64 hex characters stay the same while another 64 are appended:
483366601360a8771c6863080cc4114d8db44530f8f1e1ee4f94ea37e78b5739d5a15bef186a5386c75744c0527e1faa9f8726e462a12a4feb06bd8801e751e4
And hello world at 32 bytes gives 369771bb2cb9d2b04c1d54cca487e372d9f187f73f7ba3f65b95c8ee7798c527. Each byte is two hex characters, so the 128-byte maximum is a 256-character string. Click Generate again after moving the slider; the result doesn't update by itself. An empty input produces no output.
Security depends on the length you pick
FIPS 202 gives SHAKE256 a ceiling of 256 bits. Below that ceiling, the output length decides the strength: collision resistance is half the output bits, preimage resistance the full output bits.
| Output | Collision resistance | Preimage resistance | Compare with |
|---|---|---|---|
| 16 bytes | 64 bits | 128 bits | Too short for collision-sensitive uses |
| 32 bytes (default) | 128 bits | 256 bits | SHA3-256's collision level |
| 48 bytes | 192 bits | 256 bits | SHA3-384's collision level |
| 64 bytes | 256 bits | 256 bits | SHA3-512 collisions, lower preimage cap |
| 114 bytes | 256 bits | 256 bits | Ed448's hash length |
| 128 bytes | 256 bits | 256 bits | This tool's maximum |
So SHAKE256 at 64 bytes isn't a drop-in for SHA3-512. It's equally collision-resistant, its preimage bound is 256 bits rather than 512, and the two return entirely different bytes. If a specification names SHA3-512, use the SHA3-512 generator.
Where SHAKE256 shows up
Ed448 signatures. RFC 8032 defines Ed448 with SHAKE256 as its hash, producing 114 bytes each time (twice the 57-byte key size). That's one of the few places a fixed hash simply wouldn't do, since no SHA-3 hash outputs 114 bytes.
Post-quantum standards. ML-KEM in FIPS 203 uses SHAKE256 for its pseudorandom function and to derive the shared secret on decapsulation failure, while ML-DSA in FIPS 204 uses it to hash messages and expand seeds.
Customised hashing and MACs. SP 800-185 builds cSHAKE256 and KMAC256 on top of it, adding a customization string and, for KMAC, a key.
Practical uses for this page
- Checking a library. Hash
abcat 32 bytes and compare with the value above before trusting a new implementation. - Matching a variable-length fingerprint. If a system stores, say, 20-byte SHAKE256 identifiers, set the slider to 20 and compare.
- Seeing the prefix property. Generate at 16, 32 and 64 bytes to watch the output extend rather than change. That's why two lengths of the same input must never be treated as independent values.
Limits
The tool hashes text only (UTF-8), so it can't reproduce protocols that feed SHAKE256 binary seeds or prefixes. Output is capped at 128 bytes, enough for any common use. It isn't a key derivation function for passwords; it's fast, and passwords need deliberately slow functions such as Argon2id, per the OWASP Password Storage Cheat Sheet. For keyed authentication between two systems, the widely supported option is the HMAC generator.
If you only need 128-bit security and want more speed, SHAKE128 absorbs 168 bytes per permutation instead of 136. For a familiar fixed-length digest, see the hash generator.
Last updated