SHA-3 hash generator

Text hashed as UTF-8

Or drop a file here, or click to choose one. Files of any size work.

OutputHexBase64Base64url

Uppercase hex

Nothing you type or drop here leaves your browser. Files are read in 4 MB pieces by a background worker.

This SHA3 hash generator computes the SHA3-256 digest of text or a file in your browser, and nothing is uploaded. (The hash generator also does SHA3-512.) SHA-3 is NIST's newest hash standard, and it's built in a completely different way from MD5, SHA-1 and SHA-2. One warning before you compare digests with a blockchain tool: SHA3-256 and Keccak-256 are not the same function. That's explained below.

Why NIST wanted a second design

Xiaoyun Wang's attacks on MD5 and SHA-1 worried NIST, because SHA-2 has the same basic structure as those two and might one day fall to a similar attack. In 2007 it opened a public competition for something different. Of the 64 submissions, Keccak won in October 2012. Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche designed it, and NIST published the standard as FIPS 202 in 2015. SHA-2 hasn't been broken, so SHA-3 isn't a replacement. It's insurance, a second and unrelated design to switch to if the first is ever damaged.

The sponge

SHA-2 chains a compression function. SHA-3 is a sponge instead. Its state is 1,600 bits laid out as a 5 × 5 grid of 64-bit lanes, stirred by one fixed permutation, Keccak-f[1600], which runs 24 rounds. The state splits into a rate, the part the message touches, and a capacity, the part it never touches directly. To hash, the sponge absorbs the message one rate-sized piece at a time, XORing each piece into the rate part and scrambling the whole state. Then it squeezes the digest out of the rate part. SHA3-256 has a rate of 1,088 bits and a capacity of 512, and SHA3-512 has 576 and 1,024. A bigger capacity buys security and costs speed.

Two practical things follow from that design:

• No length extension. The capacity part is never output, so a digest doesn't reveal the whole state, and the trick that breaks SHA-256(key + message) fails here (HMAC). SHA-3 can be used as a keyed hash directly.
• Variable output. Keep squeezing and you have an extendable-output function. SHAKE128 and SHAKE256, in the same standard, give you as many bytes as you ask for.

Known values

For SHA3-512 the empty input gives a69f73cca23a9ac5c8b567dc185a756e97c982164fe25859e0d1dcc1475c80a615b2123af1f5f94c11e3e9402c3ac558f500199d95b6d3e301758586281dcd26.

SHA-3 is not Keccak

Before standardizing, NIST made one small change to Keccak. It appends two extra bits (01) to the message ahead of the usual padding, which separates the SHA-3 functions from SHAKE and leaves room for tree hashing. So the standardized SHA3-256 and the original Keccak-256 give different digests for the same input. Ethereum adopted Keccak before the standard was final and kept the original padding, which means Ethereum's "keccak256" doesn't match SHA3-256. If your digest differs from a blockchain tool's, check this first.

Speed, and who actually uses it

In software on common processors SHA-3 is usually slower than SHA-2, which has dedicated hardware instructions. In hardware it's faster. Since SHA-2 is unbroken and quick, most systems still use it. SHA-3 turns up where its structure helps. The post-quantum schemes ML-KEM and ML-DSA use SHAKE internally, and some standards want it as the alternative option. For everyday checksums the SHA-256 and SHA-512 pages are the simpler choice.

Common questions