SHAKE128 / SHAKE256 (XOF)
Squeeze any number of bytes out of SHAKE128 or SHAKE256 — an extendable-output function, not a fixed-size digest.
Input
SHAKE128
Enter something above to see the result.
Output of any length
An ordinary hash gives you a fixed number of bytes. An extendable-output function lets you ask for however many you need, and a longer request is simply a longer prefix of the same stream — asking for 64 bytes gives you the 32-byte answer followed by 32 more.
That makes it a natural key-derivation and mask-generation primitive: post-quantum schemes such as ML-KEM use SHAKE to expand a seed into as much material as the algorithm needs.
- SHAKE128 / SHAKE256 — the number is the security level, not the output size.
- cSHAKE — the same, plus a customization string so two uses in one system never produce the same stream.
- KMAC — keyed, and the SHA-3 era answer to HMAC.
- TupleHash — hashes a list of strings unambiguously, so ["ab","c"] and ["a","bc"] differ.
Frequently asked questions
Does SHAKE256 produce 256 bits?
Not necessarily — you choose the length. The 256 is the security level. SHAKE128 can output 64 bytes too; it just offers 128-bit security while doing so.
Why does a longer output share a prefix with a shorter one?
Because squeezing is a stream. That is the defining property of an XOF, and it means you must not treat two different-length outputs of the same input as independent values.