About the Shake-256 Hash Generator
SHAKE256 is the stronger of the two extendable output functions standardised in FIPS 202. Its sponge reserves twice as much capacity as SHAKE128, so it absorbs 136 bytes per permutation instead of 168 and delivers a 256-bit security level in return. Everything else about the interface is the same: name a length in bits and the state keeps producing bytes until it has given you that many.
That combination of a strong security level and a free output size makes it the workhorse of newer designs. Ed448 uses it as its internal hash. Several signature schemes selected in the post quantum standardisation process call it for both hashing and seed expansion. It also fits naturally as a key derivation step where one high entropy secret has to fan out into a nonce, an encryption key and an authentication key, since you can squeeze the whole run in one call and slice it up afterwards.
A practical detail worth knowing: because output is a stream, two calls that differ only in the requested length share a prefix. Asking for 64 bytes and then for 32 gives you the same first 32 bytes, which is convenient for testing and dangerous if you were hoping two derived values would be unrelated. Domain separate them by putting a distinct label in the input instead. Length here is set in bits and rounded to whole bytes, and hex or Base64 output is available. Everything runs in the page with no request to a server. For the faster 128-bit level see the Shake-128 Hash Generator, and for a fixed 512-bit digest see SHA3-512.
How to use
- Enter the secret, seed or message you want to expand into the left pane.
- Set Output bits to the exact amount of material the design calls for.
- Read the stream as hex, or choose Base64 for a more compact form.
- Copy or download the result and slice it into the keys you need.
Common questions
- What is the difference between SHAKE128 and SHAKE256?
- Only the capacity of the sponge. SHAKE256 gives a 256-bit security level and absorbs fewer bytes per permutation, so it is somewhat slower for the same message.
- Can I use SHAKE256 as a key derivation function?
- For expanding one already strong secret, yes. It is not a password hash, so anything derived from a human chosen password should go through Argon2 or bcrypt first.
- Why does my 512-bit result start with my 256-bit result?
- The output is a stream squeezed from one state, so shorter requests are prefixes of longer ones. Add a distinguishing label to the input when you need unrelated values.
- Is SHAKE256 approved for signatures?
- Yes, FIPS 202 defines it and it appears inside Ed448 and several standardised post quantum signature schemes.