Waiting for inputSHA3-256 is not SHA-256. Same 64 hex characters, different sponge. Ethereum Keccak-256 uses a different padding byte. Hash once, then read all three rows before you blame the file.
Waiting for inputWaiting for inputWaiting for inputTreating SHA3-256 as SHA-256 with a marketing 3 is the checksum mistake I keep seeing in issue trackers. The names were a committee accident. The bytes were not.
Both print 64 hexadecimal characters. Both claim 256 bits. One compresses 512-bit blocks with a Merkle-Damgård chain inherited from SHA-1. The other soaks the message into a 1600-bit Keccak sponge, then squeezes 256 bits out. A spreadsheet will accept either string in the same cell. A verifier will not.
Paste abc in the box. Three rows fill. None of them match.
Opened this tab because a published checksum refused to match sha256sum?
Stop hashing the file. Read the SHA-256 row. The download is often intact. The algorithm on the release page was SHA-256, or SHA3-256, and someone copied the other one into the ticket.
Opened this tab because web3.sha3 or Solidity keccak256 refused to match OpenSSL?
Read the Keccak-256 row. Ethereum never adopted the NIST padding byte. The chain shipped the raw sponge in 2015. Contract addresses still depend on padding 0x01, so the suffix never moved.
Copy the first row when a spec named SHA3-256 on purpose. Linux packages, FIPS 202, openssl dgst -sha3-256, Python hashlib.sha3_256. Copy the third row for Ethereum. Copy the second row for Git, sha256sum, and almost every REST API. Mixing those three in one ticket wastes an afternoon.
Keccak won the NIST SHA-3 competition in 2012. NIST then added a two-bit domain separator so a SHA-3 digest would never collide with a raw Keccak digest of the same length. The padding byte became 0x06 for SHA-3. The raw sponge kept 0x01.
Ethereum had already shipped Keccak-256. Changing the padding would have rewritten storage slots, contract addresses, and every signed payload. The chain kept 0x01.
Library names still lie. Python hashlib.sha3_256 is NIST. Solidity keccak256 is the raw sponge. Many versions of CryptoJS SHA3 are the raw sponge too. A snippet titled SHA3-256 on a forum often matches the third row on this page, never the first. I still see those snippets pasted into production. Pick one padding, then stop mixing them.
Go's sha3.New256 is NIST. Go's sha3.NewLegacyKeccak256 is Ethereum. The word Legacy in the second name is doing honest work. Most other languages were less careful.
SHA-256 belongs to the Merkle-Damgård family. The compression function's internal state is the digest itself. Hand someone SHA-256(secret || message) plus the length of the secret, and they compute a valid digest for secret || message || padding || extra without ever learning the secret. Bitcoin hashes twice to hide the state. HMAC exists for the same leak. The SHA256 Hash Generator prints the double digest for the Bitcoin case. The HMAC Generator is the construction to reach for when a shared key is part of the job.
SHA-3 does not leak. The squeezed bits are not the sponge's full state. Extending a SHA3-256 digest without the original input fails.
Keyed work still wants HMAC. Dropping HMAC because SHA-3 resists extension is a fashionable mistake. A bare digest of a request body proves nothing about who sent the body. Use HMAC-SHA3 or HMAC-SHA-256 when a secret is involved. This page has no key field on purpose.
SHA-3 is a family, not a single function. Capacity is twice the digest length. Rate is whatever remains of the 1600-bit state. Wider output means a smaller rate, so SHA3-512 is slower on the same message than SHA3-256, which is the opposite of SHA-512 versus SHA-256 on 64-bit hardware.
0x1F). You pick the byte length. The SHAKE256 Hash Generator is the page for a digest whose length is not 32 bytes.SHA-2 is a different family still. The SHA-2 Hash Generator prints SHA-224, SHA-256, SHA-384, and SHA-512 of one input together, which is the right desk when a document said SHA-2 and refused to name a member.
Trust this page after matching it once on a machine you already own:
printf 'abc' | openssl dgst -sha3-256
python -c "import hashlib; print(hashlib.sha3_256(b'abc').hexdigest())"
openssl dgst -sha3-256 release.tar.gzThe first line must print 3a985da74fe225b2045c172d6bd390bd855f086e3e9d525b46bfe24511431532. The empty-string button above must print a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a. Those are FIPS 202 Appendix A vectors. If a library disagrees with either one, the library is hashing Keccak, or SHA-256, or adding a newline you did not ask for.
echo abc appends a newline. Four bytes, not three. The digest will not match the abc chip. Use printf, or echo -n, when comparing a typed string against this page.
Windows certutil -hashfile still has no SHA-3 algorithm name in older builds. PowerShell Get-FileHash grew SHA3-256 in recent versions. On a box where neither exists, OpenSSL is the boring path.
Python people hashing Ethereum data want sha3.keccak_256 from pysha3, or eth_hash, never hashlib.sha3_256. The names are close enough to ruin a morning.
SHA3-256 is built for speed. A rented GPU tests guesses against it at the same order of magnitude as SHA-256. Adding a salt stops a rainbow table. The salt does nothing about throughput. Password storage wants Argon2id, with bcrypt or scrypt as accepted stand-ins. All three spend time and memory on purpose. A SHA-3 digest of a password is a leftover from tutorials written before those functions were common.
A few more refusals, so the page does not pretend to be a cryptography suite:
openssl dgst -sha3-256 on the machine that holds the file. The Checksum Validator is the page for a whole manifest, not one file.Hashing never leaves the tab. There is no upload step. Close the tab and the buffers go with it. Load the page once, cut the network, and the bench keeps working, which is the point of running FIPS 202 in the browser instead of posting a release tarball to a stranger's server.
Most mismatches on this page are a padding byte or a family name, not a corrupt download.
OpenSSL dgst -sha3-256 is NIST FIPS 202. web3.sha3 and Solidity keccak256 are the raw Keccak sponge with padding 0x01. Same capacity, different suffix. The first and third rows above are those two answers. Neither is a bug in the file.
The published value is the SHA-2 digest of the same bytes. Release notes, Git, and sha256sum print SHA-256. If the vendor wrote SHA256 in the filename, believe the vendor, not the word hash. Use the SHA-256 row, or open the SHA256 Hash Generator, to finish the check.
For collision and preimage work against a full-width digest, both are fine for new designs. SHA-3 wins on length extension, because the squeezed bits are not the sponge state. SHA-256 still dominates TLS, Git, and Linux packaging. Pick SHA-3 when a spec named SHA-3, or when you want a different internal design from SHA-2, not because SHA-256 is falling over.
The empty string is a NIST test vector. SHA3-256 of zero bytes is a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a. A tool that leaves the output blank on empty input is being polite, not correct. Click empty to confirm this page still matches Appendix A.
No. Speed is the point of SHA3-256 and the enemy of password storage. Use Argon2id. bcrypt and scrypt remain accepted alternatives. All three salt internally and cost time per guess. A salted SHA-3 digest is still a fast hash with extra steps.
Often CryptoJS. In the 4.x line, SHA3 is the raw Keccak sponge, so the output matches the third row. Python hashlib.sha3_256 and openssl dgst -sha3-256 match the first row. If a dependency is already emitting Keccak, keep using Keccak. Do not rename the digest SHA3-256 in a comment to make the ticket close.
No. The ceiling is 16 MB because Keccak runs in JavaScript in the tab. openssl dgst -sha3-256 streams the file on disk and does not care about heap size. Use that for images, installers, and anything you would not paste into a textarea.
No. SHA3-256 and Keccak-256 run in this tab. SHA-256 uses the Web Crypto API in the same tab. Closing the page drops the buffers. A private key, an internal build, or a customer export stays on the machine.
