Cybersecurity glossary
What is Secure Hash Algorithm 3 (SHA-3)?
Learn what SHA-3 is, how the Keccak sponge construction differs from SHA-2, where SHA-3 and SHAKE fit, and when teams should adopt it alongside SHA-2.
Definition
Secure Hash Algorithm 3 (SHA-3) is a NIST hash function family based on the Keccak sponge construction, providing fixed-length digests such as SHA3-256 and extensible-output functions (SHAKE) as an alternative structural design to SHA-2.
Why SHA-3 exists beside SHA-2
After SHA-1’s weaknesses, NIST sought a hash design not based on the same Merkle–Damgård structure as SHA-2. SHA-3 standardized Keccak’s sponge construction, giving the ecosystem a second secure hash family and flexible SHAKE outputs for modern protocol engineering.
SHA-3 capabilities
Fixed digests
SHA3-224/256/384/512 provide drop-in style digest lengths.
Sponge construction
Absorbs input and squeezes output through a permutation-based state.
SHAKE XOFs
Variable-length output for KDFs, masking, and protocol helpers.
Algorithm diversity
Reduces systemic risk of depending on a single hash structure.
Choosing SHA-3 in a design
Check protocol requirements
Prefer the hash the standard already negotiates (often SHA-2 in TLS).
Pick digest or XOF
Use SHA3-256 for fixed digests; SHAKE when variable output is specified.
Use a vetted library
Call FIPS 202 implementations rather than unofficial Keccak variants.
Bind with keys or signatures when needed
Unkeyed digests alone do not authenticate adversarial channels.
Document the exact algorithm name
Avoid ambiguous “Keccak-256” labels in interoperability contracts.
SHA-2 vs SHA-3 selection cues
Both are approved. Ecosystem fit usually decides.
| Topic | SHA-2 | SHA-3 |
|---|---|---|
| Internal design | Merkle–Damgård | Sponge (Keccak) |
| Web/TLS prevalence | Very high | Growing but less ubiquitous |
| Variable output | Not native | SHAKE128/256 |
| Password storage | Not appropriate alone | Not appropriate alone |
Operational checklist
- Use standard SHA3-* and SHAKE names from FIPS 202/SP 800-185.
- Do not break TLS or certificate interoperability by unilaterally switching hashes.
- Prefer SHA-3 when a specification calls for SHAKE or algorithm agility goals.
- Keep SHA-1 out of security-critical paths regardless of SHA-3 adoption.
- Never use raw SHA-3 for password verifiers.
- Validate test vectors when enabling a new crypto provider.
- Track which products advertise SHA-3 acceleration or FIPS modules.
- Record algorithm identifiers in protocols to prevent downgrade to weaker hashes.
Diversity is a strategy, not a fashion statement
Migrating every digest to SHA-3 without protocol support creates incompatibility without clear security gain over SHA-2. The strategic value is having an independent design available—especially SHAKE—when standards need it.
The practical takeaway
SHA-3 is NIST’s sponge-based hash family and SHAKE XOF toolkit. Keep using SHA-2 where ecosystems demand it, adopt SHA-3/SHAKE when protocols benefit, and never confuse general hashes with password hashing.
Related security terms
Secure Hash Algorithm 2 (SHA-2)
The widely deployed Merkle–Damgård hash family SHA-3 complements.
HMAC
Keyed integrity constructions that can use SHA-3 in some profiles.
Key Derivation Function (KDF)
SHAKE and other XOFs are sometimes used in modern KDF designs.
CSPRNG
Hash and sponge constructions appear in some DRBG designs.
Symmetric Cryptography
Broader primitives that rely on hash functions for transcripts and keys.
Frequently asked questions
What is SHA-3 in simple terms?
SHA-3 is another official family of cryptographic hash functions. It produces digests like SHA-2 but uses a different internal design called a sponge.
Does SHA-3 replace SHA-2?
Not automatically. SHA-2 remains secure and dominant. SHA-3 provides algorithmic diversity and useful XOF modes (SHAKE) for protocols that need them.
What is SHAKE?
SHAKE128 and SHAKE256 are extensible-output functions in the SHA-3 standard. They can produce variable-length output from the sponge.
Is Keccak the same as SHA-3?
SHA-3 is the NIST-standardized parameterization of Keccak. Informal “Keccak” output lengths can differ from SHA-3 digest definitions, so use standard names carefully.
Should new apps switch everything to SHA-3?
Only when a protocol or policy requires it, or when you specifically need SHAKE. Otherwise SHA-256/SHA-384 interoperability usually wins.
Can SHA-3 store passwords?
No. Like SHA-2, it is a fast general-purpose hash. Use Argon2id or similar password KDFs.
Is SHA-3 quantum-proof?
Hash functions are impacted differently than public-key crypto, but SHA-3 is not a complete post-quantum cryptography strategy by itself.
References
Explore authoritative guidance and frameworks related to secure hash algorithm 3 (sha-3).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.