What is SHA-3?
SHA-3 is the third generation of the Secure Hash Algorithm family, standardized in FIPS 202 (2015). It was the result of a public, seven-year NIST competition that began in 2007 and ended in 2012 with Keccak — a hash designed by Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche — as the winner. The final SHA-3 standard differs from the submitted Keccak only in a minor padding tweak agreed with the designers.
SHA-3 delivers four fixed-size hashes — SHA3-224, SHA3-256, SHA3-384, and SHA3-512 — plus two extendable-output functions, SHAKE128 and SHAKE256. It was not designed to outperform SHA-2 in software; its role is insurance: an independent, modern architecture that does not share SHA-2's design lineage, so a future weakness in one family need not afflict the other.
The sponge construction
SHA-2 processes input through a Merkle–Damgård chain of compression functions; SHA-3 instead permutes a 1600-bit state with a fixed permutation called Keccak-f. The construction has two phases:
- Absorb. The input is padded and XORed into the state rate-by-rate, permuting the full state after each block.
- Squeeze. Once all input is absorbed, output is read from the rate portion; if a longer output is needed (SHAKE), the state is permuted and read again.
This is why SHA-3 is immune to length extension: nothing about the absorbed message is emitted back out, so an attacker cannot continue the computation with extra blocks the way they can against a Merkle–Damgård hash.
The four sizes and SHAKE
The four SHA-3 digests differ in rate and capacity, which sets their security ceiling:
| Algorithm | Output | Collision resistance |
|---|---|---|
| SHA3-224 | 28 bytes / 56 hex | 112-bit |
| SHA3-256 | 32 bytes / 64 hex | 128-bit |
| SHA3-384 | 48 bytes / 96 hex | 192-bit |
| SHA3-512 | 64 bytes / 128 hex | 256-bit |
| SHAKE128 | any length | ≥128-bit |
| SHAKE256 | any length | ≥256-bit |
Security properties
No practical collision, preimage, or second-preimage attack is known against any SHA-3 size, and the Keccak permutation has survived more than a decade of scrutiny from the sponge-focused research community. Beyond the usual targets, SHA-3 resists length-extension attacks outright and its sponge design separates the rate (throughput) and capacity (security) parameters, making the security analysis unusually clean and quantitative.
SHA-3 vs SHA-2 vs pre-standard Keccak
- Versus SHA-2: different construction, same security targets, generally slower in software but very fast on hardware (FPGAs/ASICs), no length extension, plus SHAKE XOFs.
- Versus original Keccak: original-format Keccak hashes (e.g.
Keccak-256) differ from SHA3-256 because of the padding tweak. Some ecosystems (notably Ethereum) still use the pre-standard Keccak; they do not match this tool.
How this tool works
SHA-3 is not exposed by the Web Crypto API, so this page uses the hash-wasm
WebAssembly build. One WASM module is loaded once and reused for all four sizes, so the first digest
pays a small init cost and everything after is effectively instant. Input is converted to bytes on
your device (UTF-8, hex, or Base64), hashed locally, and never transmitted.
Worked examples you can verify right now
| Input | SHA3-256 digest |
|---|---|
(empty string) | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a |
hello world | 644bcc7e564373040999aac89e7622f3ca71fba1d972fd94a31c3bfbf24e3938 |
The quick brown fox jumps over the lazy dog | 69070dda01975c8c120c3aada1b282394e7f032fa9cf32f4cb2259a0897dfc04 |
Re-type any row above (UTF-8 bytes exactly, including the period in the fox sentence) and this tool returns precisely these 64-character digests. Switch the algorithm selector and the output length will change with it.