SHA3-256 Hash Generator

Compute a SHA3-256 digest. Immune to the length-extension attack that SHA-2 needs HMAC to work around.

Enter something above to see the result.

A different design, not a patched one

SHA-3 was not created because SHA-2 broke. It was standardised so that the world would have a second, structurally unrelated hash ready if SHA-2 ever did — SHA-1 and SHA-2 share a lineage, and a break in one would have been worrying for the other.

Where SHA-2 uses a Merkle–Damgård chain, SHA-3 is a sponge: input is absorbed into a large permuted state, and output is squeezed back out of it.

Immune to length extension

Given SHA-256(secret ‖ message) and the length of the secret, an attacker can compute SHA-256(secret ‖ message ‖ padding ‖ extra) without knowing the secret. That is why naive MAC constructions need HMAC.

The sponge keeps part of its state hidden at every step, so SHA-3 has no such property. A bare SHA-3 of a secret and a message is already a sound MAC — though KMAC is the purpose-built option.

Frequently asked questions

Should I switch from SHA-256 to SHA-3?

There is no urgency. SHA-256 has no practical weakness and is faster in hardware. Choose SHA-3 for new designs that want length-extension resistance for free, or where a standard requires it.

Is SHA3-256 the same as Keccak-256?

No — and this catches people out. NIST changed the padding byte during standardisation, so the two produce entirely different digests at the same output size. Ethereum uses the original Keccak.

Why is it slower than SHA-256 here?

SHA-256 runs on a dedicated CPU instruction through Web Crypto; SHA-3 is computed in JavaScript. For text-sized input the difference is imperceptible.