cSHAKE128 Hash Generator
Compute cSHAKE128 with function name N, customization string S and any output length. Verified against NIST SP 800-185 samples, runs in your browser.
A multiple of 8, from 8 to 16384 bits.
Usually left empty. Reserved by NIST for functions built on cSHAKE.
Optional domain-separation label, e.g. your application name. Different strings give unrelated outputs.
Runs entirely in your browser. Your data is never uploaded.
What is cSHAKE128 Hash Generator?
cSHAKE128 is the customizable version of SHAKE128 defined in NIST SP 800-185. It adds a function name N and a customization string S so that the same message hashed for different purposes gives unrelated outputs. This tool lets you set N, S and the output length.
How to use cSHAKE128 Hash Generator
- Type or paste your input into Text to hash — the digest updates as you type (an empty box shows the hash of empty input).
- Choose the Input encoding: Text (UTF-8) hashes the characters as UTF-8, Hex bytes or Base64 hash the decoded raw bytes.
- Set Output length (bits) (default 256).
- Optionally fill in Function name (N) (normally empty) and Customization string (S), e.g. your application or protocol name.
- Pick the Output format (hex lowercase, hex uppercase or Base64) and click Copy.
Example
Data 00010203 (Hex bytes), N empty, S = "Email Signature", 256 bits
c1c36925b6409a04f1b504fcbca9d82b4017277cb5ed2b2065fc1d3814d5aaf5
NIST SP 800-185 cSHAKE sample #1.
When to use cSHAKE128 Hash Generator
Use cSHAKE128 when you need domain separation: several hashes derived from the same data for different purposes (key derivation labels, protocol transcripts, tagged hashes). Use plain SHAKE128 if no customization is needed, and KMAC128 if a secret key is involved. N is reserved for NIST-defined functions; applications should normally use S only.
How cSHAKE128 Hash Generator works
cSHAKE128 (NIST SP 800-185) is SHAKE128 with domain separation. Before the message, it absorbs bytepad(encode_string(N) || encode_string(S), 168) — the function name N and the customization string S, each prefixed with their bit length — and then pads with suffix 00 instead of SHAKE's 1111. If both N and S are empty, cSHAKE128 is defined to equal SHAKE128. Different N or S values give independent functions. N and S are entered as text and encoded as UTF-8.
Common Use Cases
- Reproduce the NIST SP 800-185 cSHAKE test vectors
- Derive separate values for different contexts from one input
- Implement or debug KMAC, TupleHash or ParallelHash, which are built on cSHAKE
- Hash protocol messages with an application-specific label
Security Note
cSHAKE128 offers 128-bit security like SHAKE128. The customization string is public, not a key — use KMAC128 for authentication. Computation is local to your browser.
FAQs
What happens if N and S are both empty?
By definition cSHAKE128 then equals SHAKE128; for abc with 256 bits you get 5881092dd818bf5c…, the same as SHAKE128.
What is the difference between N and S?
N (function name) is reserved for functions defined by NIST, such as "KMAC" or "TupleHash". S is the free customization string for applications. In practice you set S and leave N empty.
How are N and S encoded?
As UTF-8 bytes, prefixed with their length in bits (left_encode), then padded to the rate as specified in SP 800-185.