cSHAKE (customizable XOF)
SHAKE with a customization string, so two uses of the same function in one system can never collide.
Input
cSHAKE128
Enter something above to see the result.
Output of any length
An ordinary hash gives you a fixed number of bytes. An extendable-output function lets you ask for however many you need, and a longer request is simply a longer prefix of the same stream — asking for 64 bytes gives you the 32-byte answer followed by 32 more.
That makes it a natural key-derivation and mask-generation primitive: post-quantum schemes such as ML-KEM use SHAKE to expand a seed into as much material as the algorithm needs.
- SHAKE128 / SHAKE256 — the number is the security level, not the output size.
- cSHAKE — the same, plus a customization string so two uses in one system never produce the same stream.
- KMAC — keyed, and the SHA-3 era answer to HMAC.
- TupleHash — hashes a list of strings unambiguously, so ["ab","c"] and ["a","bc"] differ.
Frequently asked questions
Does SHAKE256 produce 256 bits?
Not necessarily — you choose the length. The 256 is the security level. SHAKE128 can output 64 bytes too; it just offers 128-bit security while doing so.
Why does a longer output share a prefix with a shorter one?
Because squeezing is a stream. That is the defining property of an XOF, and it means you must not treat two different-length outputs of the same input as independent values.