SHA-256 is a sound default for most application work, and SHA-3 is a standardized alternative when a protocol or requirement calls for it. Neither is the right tool for passwords. The choice between them matters far less than choosing the right construction: a plain hash, an HMAC, a signature, or a password hash.
What each one is
NIST published SHA-3 as FIPS 202 in August 2015. It specifies four hash functions, SHA3-224, SHA3-256, SHA3-384 and SHA3-512, plus two extendable output functions, SHAKE128 and SHAKE256. SHA-256 belongs to the older SHA-2 family, which NIST specifies in FIPS 180-4, the Secure Hash Standard.
SHA-3 was added to the standard set as a second, differently built family, so that a break in one design would not leave everyone without an alternative.
Choosing in practice
| Need | Use |
|---|---|
| Integrity check of a file or artifact | SHA-256 or SHA3-256 |
| Message authentication with a shared secret | HMAC, with SHA-256 for example |
| Signatures and certificates | What the protocol specifies, usually SHA-256 |
| Password storage | A password hash such as Argon2id |
| Derive several keys from one secret | A key derivation function |
| Variable length output | SHAKE, if you know why you need it |
Support is the practical tie breaker. SHA-256 is available almost everywhere, and many protocols name it. The OWASP TLS guidance says certificates should use SHA-256. Pick SHA-3 when a spec, partner, or policy asks for it.
Notes on HMAC
The Python documentation says extendable output functions such as SHAKE-128 and SHAKE-256 cannot be used with HMAC, because HMAC needs a fixed digest size. Use a fixed output hash there.
Things to avoid regardless
- MD5 and SHA-1 for any trust decision. CWE-327 lists both as once strong and now breakable, and the SHAttered work showed a real SHA-1 collision.
- A bare hash of a secret and a message as a homemade MAC. Use HMAC.
- A fast hash for passwords.
- Truncating digests without understanding what you lose.
- Hash comparisons with ==, when the value is a secret or MAC.
Record the algorithm
Store the algorithm name with each digest, for example sha256:value. If you later need SHA3-256 or something else, old records still say what they are. That small habit is crypto agility in practice, which CWE-327 recommends.
A tiny decision rule
If you are writing new code and nothing forces a choice, use SHA-256. If a standard or customer names SHA-3, use it. If you are hashing a password, stop and use a password hash.
Related reading
See are MD5 and SHA-1 still safe for checksums, and hash, MAC, signature or encryption for choosing the right construction.
Safeguard can generate an SBOM and scan your dependencies, so outdated cryptography libraries with known advisories show up in one inventory, and policies can gate a build on them. A free scan is at gold.safeguard.sh/scan.
Quick check
Is SHA-3 more secure than SHA-256?
They are different designs. Neither has a practical break cited in the sources used here, so security alone is rarely a reason to switch. Follow requirements and library support.
Can I use SHA-3 for passwords?
No. It is still a fast general hash. Use a password hashing algorithm.
Sources
- NIST FIPS 202, SHA-3 Standard
- NIST FIPS 180-4, Secure Hash Standard
- Python documentation, hmac
- SHAttered
- CWE-327
- OWASP Transport Layer Security Cheat Sheet
Last reviewed: 19 October 2026.
