SHA3-512: Maximum Sponge Capacity and When to Choose It
SHA3-512 is the widest SHA-3 function, giving 512 bits as 128 hex characters. It absorbs only 576 bits per permutation instead of 1088, so it is roughly half the speed of SHA3-256 for double the output width.
At a glance
- Digest size
- 512 bits
- Hex characters
- 128
- Rate and capacity
- Rate 576 bits (72 bytes) absorbed per permutation, capacity 1024 bits held back
- Standard
- FIPS 202 (2015), the widest of the four fixed length SHA-3 functions
- Broken for collisions
- No. No practical attack on the full function
- Safe for password storage
- No. Use a memory-hard password hash such as Argon2id, scrypt or bcrypt
- Available in the generator
- Yes, computed alongside SHA3-256 and Keccak-256
In detail
The SHA-3 sponge trades rate against capacity out of a fixed 1600 bit state. SHA3-256 absorbs 1088 bits per permutation and reserves 512; SHA3-512 absorbs only 576 and reserves 1024. Because the permutation costs the same either way, SHA3-512 does roughly twice as many permutations per megabyte of input. That is the entire performance story, and it is why SHA3-512 is noticeably slower on large files.
What the larger capacity buys is a 256 bit security level against collisions rather than 128 bits. Both numbers are unreachable with any conceivable hardware, so the choice is driven by policy and protocol rather than by threat. Compliance profiles that specify a 256 bit security level, and long lived archival signatures where the cost of being wrong in forty years is high, are the honest reasons to pick it.
As with SHA3-256, the sponge means the digest is not the internal state, so length extension does not apply. It also means the same permutation and the same code path serve every SHA-3 variant, so a library that offers SHA3-256 almost always offers SHA3-512 at no extra integration cost. The only thing that changes is the padding domain and the rate.
Support is the practical constraint. SHA3-512 is well covered in modern cryptographic libraries but poorly covered in older database functions, shell utilities and language standard libraries that predate 2015. Before standardising on it internally, confirm that every service which will verify the digest can produce it, because a 128 character mismatch is an unpleasant thing to debug across a service boundary.
It is not a password hash. The temptation is real, because it is the slowest thing on this page, but it is still measured in microseconds and it uses no meaningful memory, so a GPU attack scales freely against it. Passwords need Argon2id, scrypt or bcrypt with a tuned cost and memory parameter. ToolBox does not offer a password hashing tool and this generator is not one.
Examples
a69f73cca23a9ac5c8b567dc185a756e97c982164fe25859e0d1dcc1
475c80a615b2123af1f5f94c11e3e9402c3ac558f500199d95b6d3e3
01758586281dcd26Shown wrapped. The real digest is 128 unbroken hex characters.
b751850b1a57168a5693cd924b6b096e08f621827444f70d884f5d02
40d2712e10e116e9192af3c91a7ec57647e3934057340b4cf408d5a5
6592f8274eec53f0Things that catch people out
- SHA3-512 and SHA-512 are unrelated designs that happen to share an output width. A 128 character digest tells you nothing about which one produced it, and the generator's Verify tab will list both when you paste one in.
- Halving the rate halves throughput. If you are hashing large files in a request path, benchmark before switching from SHA3-256 to SHA3-512; the difference is visible on hundreds of megabytes.
- Older tooling that exposes 'sha3-512' may be the pre-standard Keccak variant with a different padding byte. Check it against the empty string digest above before trusting it across systems.
- Choosing SHA3-512 because 512 sounds safer than 256 is not a reason. Both are far past any reachable attack, and the wider digest costs speed, storage and column width everywhere it is written down.
Try it: Hash Generator
Paste text or drop a file and get every digest at once, in hex or Base64, with a verify tab for comparing an expected value against what you actually have.
Hash Generator
LOCAL · Browser-OnlyGenerate MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, Keccak-256, CRC32, and HMAC hashes from text or files
MD5 is cryptographically broken and should not be used for security purposes. Use SHA-256 or SHA-512 instead.
Related Hash algorithms
All hash algorithms →SHA3-256: The Sponge Construction and How It Differs From SHA-256
SHA3-256 gives the same 64 hex characters as SHA-256 from a completely different construction. No length extension, different failure modes, FIPS 202.
SHA-512: 512 Bit Digests and 64 Bit Word Arithmetic
SHA-512 outputs 128 hex characters using 64 bit words and 1024 bit blocks. Why it can beat SHA-256 on 64 bit hardware, and where the extra width is pointless.
Keccak-256: Ethereum's Hash and Why It Is Not SHA3-256
Keccak-256 uses the original Keccak padding, not the FIPS 202 padding. Same 64 hex characters as SHA3-256, completely different values. Why Ethereum uses it.
HMAC-SHA-1: Still Sound Even Though SHA-1 Collisions Are Not
HMAC-SHA-1 produces a 40 character tag and is not affected by the SHA-1 collision attacks. Why that is true, and where it is still deployed today.
HMAC-SHA-256: Signing and Verifying Payloads Correctly
HMAC-SHA-256 gives a 64 character authentication tag. Why it replaces hash(secret + body), how webhook signatures use it, and how verification goes wrong.
HMAC-SHA-384: 384 Bit Tags and the 128 Byte Block Size
HMAC-SHA-384 gives a 96 character tag over a 128 byte block. Where JWT HS384 and TLS use it, and why the key length threshold is different.
Tools for this
- Hash Generator Free online hash generator - generate MD5, SHA-1, SHA-256 hashes from any input text