Question 1

What's the difference between SHA-3 and Keccak?

Accepted Answer

Keccak is the original algorithm that won the NIST hash competition in 2012. When NIST standardized it as FIPS 202 (SHA-3) in 2015, they changed the padding scheme — adding a 01 suffix before the standard Keccak padding to mark domain separation between SHA-3 and other Keccak modes. This means SHA3-256 of an input produces a DIFFERENT hash than Keccak-256 of the same input. Ethereum uses the original Keccak-256 (because Ethereum predates the SHA-3 standard); most other systems use SHA3-256. Pick carefully — passing 'SHA3' output where 'Keccak' is expected will silently produce wrong results.

Question 2

When should I use SHA-3 instead of SHA-2?

Accepted Answer

Almost never in 2026, for practical purposes. SHA-2 is still secure, ubiquitous, and faster on most CPUs (especially with SHA-NI hardware acceleration). SHA-3 was standardized as a backup in case SHA-2 falls to a surprise attack — having a completely different algorithm family (sponge construction vs Merkle-Damgård) provides diversification. Use SHA-3 when: you need protection against length-extension attacks (SHA-2 is vulnerable, SHA-3 is not, though HMAC-SHA2 is also immune), you're implementing a protocol that specifies SHA-3, you want quantum-resistant signing primitives (SLH-DSA uses SHA-3 internally).

Question 3

Why does Ethereum use Keccak-256?

Accepted Answer

Ethereum's design predates SHA-3 standardization. When Vitalik Buterin and the Ethereum team picked a hash function in 2014-2015, Keccak had won the NIST competition but the final SHA-3 standard hadn't been published. They locked in Keccak with the original padding. By the time SHA-3 launched in 2015 with modified padding, Ethereum's PoW mining, contract addresses, and transaction hashes were already deeply tied to the original Keccak — changing would have required a hard fork. So Ethereum stays on Keccak forever, and every Solidity dev needs to know that 'keccak256()' in Solidity is NOT the same as SHA3-256.

Question 4

Is SHA-3 implemented in browsers?

Accepted Answer

No — the Web Crypto API explicitly does not include SHA-3. The W3C declined to add it because SHA-2 is sufficient for current use cases and adding more algorithms increases attack surface. SHA-3 is implemented via the js-sha3 library (open-source, well-audited, ~6KB minified). The library runs entirely in your browser.

SHA-3 Generator (Keccak)

Frequently Asked Questions