What Is SHA-3?

SHA-3 (Secure Hash Algorithm 3) is the latest member of the Secure Hash Algorithm family, published by NIST in 2015. Unlike SHA-2, which is built on the Merkle-Damgård construction, SHA-3 uses a fundamentally different design called the sponge construction. This difference makes SHA-3 resistant to length extension attacks and gives it a clean, well-understood security proof.

The algorithm originally named Keccak (pronounced "ket-chak") won the NIST hash function competition in 2012 after a five-year public evaluation process. NIST standardised four fixed hash lengths — SHA3-224, SHA3-256, SHA3-384 and SHA3-512 — plus two extendable-output functions (XOFs): SHAKE128 and SHAKE256.

A short history of SHA-3

SHA-2 was published in 2001 and remains unbroken. So why did NIST run a competition for a brand-new hash function? The answer is defensive: SHA-2 shares the Merkle-Damgård design with MD5 and SHA-1, both of which were eventually broken. NIST wanted a drop-in alternative with a genuinely different internal structure, so that a future weakness in one family would not automatically affect the other.

Keccak, designed by Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche, was selected in October 2012 and standardised as FIPS PUB 202 in August 2015.

How SHA-3 works

The sponge construction

SHA-3 absorbs input in fixed-size blocks and then "squeezes" out the digest. Internally the state is split into a rate (the part that reads/writes data) and a capacity (the part kept secret). For SHA3-256 the rate is 1088 bits and the capacity is 512 bits; the capacity is what determines the security level (capacity ÷ 2).

The Keccak-f permutation

The internal state is a 5×5 grid of 64-bit lanes — 1600 bits in total. A permutation called Keccak-f[1600] is applied repeatedly (24 rounds) to mix the state. Each round applies five simple steps (θ, ρ, π, χ, ι) that are cheap in hardware and easy to reason about for cryptanalysts.

Key properties

• Not vulnerable to length extension attacks that affect SHA-2
• Backed by a security reduction for the sponge construction
• Excellent performance in hardware; competitive in software
• XOF variants (SHAKE) produce output of any length

SHA-3 vs SHA-2

Neither is "better" in absolute terms: SHA-2 is faster in software and has decades of deployment history, while SHA-3 has a cleaner security margin and a different failure mode. Most systems should keep using SHA-2 and treat SHA-3 as a well-supported alternative rather than an urgent replacement.

SHA-3 vs SHA-2 vs BLAKE2

BLAKE2 (and its successor BLAKE3) are unrelated to the NIST standard but are popular because they are very fast in software.

If your environment already standardises on NIST algorithms, SHA-3 is the natural alternative. If raw throughput is the priority and non-NIST hashes are acceptable, BLAKE2/BLAKE3 are worth benchmarking.

Fixed-length hashes and SHAKE

The four fixed outputs behave exactly like SHA-2 from a caller's point of view:

SHA3-224 → 28 bytes
SHA3-256 → 32 bytes
SHA3-384 → 48 bytes
SHA3-512 → 64 bytes

SHAKE128 and SHAKE256 are extendable-output functions: instead of a fixed digest you ask for as many bytes as you need. This makes them useful for:

• Deriving cryptographic keys of arbitrary length from a seed
• Building stream ciphers and deterministic random bit generators
• Domain separation through the XOF's customisation string

Code examples

// PHP
echo hash('sha3-256', 'hello');   // 32-byte hex digest
echo hash('sha3-512', 'hello');   // 64-byte hex digest

import hashlib

print(hashlib.sha3_256(b'hello').hexdigest())
print(hashlib.sha3_512(b'hello').hexdigest())

# SHAKE (extendable output)
print(hashlib.shake_128(b'hello').hexdigest(16))  # 16 bytes output
print(hashlib.shake_256(b'hello').hexdigest(32))  # 32 bytes output

// Node.js
const crypto = require('crypto');
console.log(crypto.createHash('sha3-256').update('hello').digest('hex'));
console.log(crypto.createHash('sha3-512').update('hello').digest('hex'));

# OpenSSL CLI
printf 'hello' | openssl dgst -sha3-256

When to use SHA-3

SHA-3 is not intended to replace SHA-2 immediately. SHA-2 remains secure, and no practical attack reduces it below acceptable levels. SHA-3 exists as a backup in case SHA-2 is eventually broken.

Use SHA-3 when:

• You need resistance to length extension attacks (for example when a hash doubles as a MAC prefix)
• Your application runs on hardware with SHA-3 acceleration
• You want to diversify cryptographic dependencies away from SHA-2
• You need a hash with a fundamentally different design (defence in depth)
• You need variable-length output from SHAKE128 or SHAKE256

Avoid SHA-3 as a password-hashing function. Like SHA-2, it is designed to be fast, which makes it unsuitable for storing passwords. Use Bcrypt, scrypt or Argon2 instead.

Common mistakes

• Using a plain hash for passwords. Fast hashes (SHA-2, SHA-3) are not password hashes. Use a slow, salted KDF.
• Truncating a digest to "save space" without understanding the security level. A truncated SHA3-256 is not the same as SHA3-224.
• Assuming SHA-3 is always slower in your stack. Benchmark with your runtime and platform before deciding.
• Mixing up SHAKE with a normal hash. shake128 requires an explicit output length; supplying none is an error in most libraries.
• Forgetting to hash file contents in binary, not text. Line-ending conversions silently change the digest.

Frequently asked questions

Is SHA-3 more secure than SHA-2? Both are considered secure. SHA-3 has a stronger theoretical margin and resists length extension attacks, but SHA-2 has no practical breaks either. The bigger factor is how you use the hash.

Should I migrate my application from SHA-2 to SHA-3? Not urgently. Migrate where you gain a concrete benefit (length-extension resistance, SHAKE, hardware acceleration) and keep SHA-2 elsewhere.

What is Keccak-256? Keccak-256 is the original competition variant with different padding. It is used by Ethereum and is not identical to the NIST SHA3-256. Feeding the same input to both produces different digests.

Can SHA-3 be used for HMAC? Yes. HMAC-SHA3 is standardised (for example in NIST SP 800-185 along with KMAC). For new systems, KMAC (Keccak-based MAC) is often the cleaner choice.

Is SHA-3 quantum-safe? No hash function alone is a complete post-quantum answer. Grover's algorithm roughly halves the effective security level, so SHA3-256 provides about 128 bits of post-quantum resistance. SHA-3 is not broken by quantum computers the way RSA and ECC are.

Try SHA-3 online

The SHA-3 Hash Generator on Help2Code computes SHA3-224, SHA3-256, SHA3-384 and SHA3-512 hashes instantly in your browser. Compare the output with SHA-2 hashes using the Multiple Hash Generator, or verify an existing digest with the Hash Checker.

Conclusion

SHA-3 is a modern, well-designed hash function with a conservative security margin. While SHA-2 remains the default for most applications, SHA-3 is an excellent choice when you need a backup hash function for defence in depth, resistance to length extension attacks, or the unique capabilities of SHAKE extendable-output functions.