Hashing · 224, 256, 384 or 512 bits
SHA-3
SHA-3 is the Keccak sponge family, standardized separately from SHA-2.
Key facts
| Outputs | 224, 256, 384 or 512 bits |
|---|---|
| Construction | Keccak sponge |
| Standard | FIPS 202 |
| Selected | NIST competition, 2012 |
| Relation | Not derived from SHA-2 |
| Browser support | Limited; not in Web Crypto |
A different construction
SHA-3 was chosen through an open NIST competition and standardized in FIPS 202. It uses a sponge construction: absorb the input into a state, then squeeze out the digest. The permutation is Keccak-f, which is unrelated to the Merkle–Damgård structure of SHA-2.
That independence is the point. If a structural weakness were found in SHA-2, SHA-3 would remain a viable alternative. It is not a patch for SHA-2 and produces completely different digests for the same input.
Where it is used
SHA-3 appears in newer standards and in systems that want algorithm diversity. Browser support is uneven: the Web Crypto API does not expose it, so client-side hashing usually stays with SHA-2. Ethereum uses Keccak-256, which is closely related but not identical to standardized SHA3-256.
Do not swap SHA-3 for SHA-256 in an existing protocol unless both ends agree. The output length may match, but the digest does not.
Frequently asked questions
Is SHA-3 a replacement for SHA-256?
It is an alternative, not a drop-in replacement. Protocol support and digest values differ.
Is Ethereum's Keccak the same as SHA-3?
No. Ethereum uses the original Keccak padding, which differs from the standardized SHA-3 padding.