cSHAKE256 Hash Generator
Compute cSHAKE256 with function name N, customization string S and any output length. Verified against NIST SP 800-185 samples, runs in your browser.
A multiple of 8, from 8 to 16384 bits.
Usually left empty. Reserved by NIST for functions built on cSHAKE.
Optional domain-separation label, e.g. your application name. Different strings give unrelated outputs.
Runs entirely in your browser. Your data is never uploaded.
What is cSHAKE256 Hash Generator?
cSHAKE256 is the customizable version of SHAKE256 defined in NIST SP 800-185. It adds a function name N and a customization string S so that the same message hashed for different purposes gives unrelated outputs. This tool lets you set N, S and the output length.
How to use cSHAKE256 Hash Generator
- Type or paste your input into Text to hash — the digest updates as you type (an empty box shows the hash of empty input).
- Choose the Input encoding: Text (UTF-8) hashes the characters as UTF-8, Hex bytes or Base64 hash the decoded raw bytes.
- Set Output length (bits) (default 512).
- Optionally fill in Function name (N) (normally empty) and Customization string (S), e.g. your application or protocol name.
- Pick the Output format (hex lowercase, hex uppercase or Base64) and click Copy.
Example
Data 00010203 (Hex bytes), N empty, S = "Email Signature", 512 bits
d008828e2b80ac9d2218ffee1d070c48b8e4c87bff32c9699d5b6896eee0edd164020e2be0560858d9c00c037e34a96937c561a74c412bb4c746469527281c8c
NIST SP 800-185 cSHAKE sample #3.
When to use cSHAKE256 Hash Generator
Use cSHAKE256 when you need domain separation: several hashes derived from the same data for different purposes (key derivation labels, protocol transcripts, tagged hashes). Use plain SHAKE256 if no customization is needed, and KMAC256 if a secret key is involved. N is reserved for NIST-defined functions; applications should normally use S only.
How cSHAKE256 Hash Generator works
cSHAKE256 (NIST SP 800-185) is SHAKE256 with domain separation. Before the message, it absorbs bytepad(encode_string(N) || encode_string(S), 136) — the function name N and the customization string S, each prefixed with their bit length — and then pads with suffix 00 instead of SHAKE's 1111. If both N and S are empty, cSHAKE256 is defined to equal SHAKE256. Different N or S values give independent functions. N and S are entered as text and encoded as UTF-8.
Common Use Cases
- Reproduce the NIST SP 800-185 cSHAKE test vectors
- Derive separate values for different contexts from one input
- Implement or debug KMAC, TupleHash or ParallelHash, which are built on cSHAKE
- Hash protocol messages with an application-specific label
Security Note
cSHAKE256 offers 256-bit security like SHAKE256. The customization string is public, not a key — use KMAC256 for authentication. Computation is local to your browser.
FAQs
What happens if N and S are both empty?
By definition cSHAKE256 then equals SHAKE256; for abc with 512 bits you get 483366601360a877…, the same as SHAKE256.
What is the difference between N and S?
N (function name) is reserved for functions defined by NIST, such as "KMAC" or "TupleHash". S is the free customization string for applications. In practice you set S and leave N empty.
How are N and S encoded?
As UTF-8 bytes, prefixed with their length in bits (left_encode), then padded to the rate as specified in SP 800-185.