Cryptographic
BLAKE2b
A 64-bit-optimized hash function derived from BLAKE, the SHA-3 finalist. Designed in 2013 by Aumasson, Neves, Wilcox-O’Hearn, and Winnerlein. Faster than SHA-2 and SHA-3, immune to length-extension, and has a built-in keyed mode that replaces HMAC.
At a glance
| Output | 1-512 bits (typically 256 or 512) |
|---|---|
| Block size | 1024 bits |
| Word size | 64 bits |
| Construction | HAIFA + ChaCha-like compression |
| Rounds | 12 |
| Standard | RFC 7693 |
| Collision security | 2output/2 generic |
| Length extension | No |
| Status | Modern, recommended |
BLAKE2 variants
- BLAKE2b , 64-bit words, 12 rounds, output up to 512 bits. Best on 64-bit CPUs.
- BLAKE2s , 32-bit words, 10 rounds, output up to 256 bits. Best on 32-bit and embedded devices.
- BLAKE2bp / BLAKE2sp , parallel variants that exploit multi-core CPUs by running independent BLAKE2 instances and combining them.
- BLAKE2X , extendable-output variants.
Built-in features
- Keyed mode ,
BLAKE2b(key, message)is a one-shot MAC, no HMAC needed. - Personalization , a 16-byte field domain-separates instances (different protocols, different versions, etc.) so digests cannot cross-pollinate.
- Salt , a 16-byte salt is part of the parameter block, useful for randomized hashing.
- Variable output , any length from 1 to 64 bytes (BLAKE2b) / 32 bytes (BLAKE2s).
- Tree mode , supports tree-structured hashing for parallel implementations.
Where it is used
- libsodium ,
crypto_generichashdefaults to BLAKE2b. - Argon2 , internal hash is BLAKE2b.
- WireGuard , keyed BLAKE2s for MACs.
- Tor , protocol pieces.
- Pijul and other modern VCSes , content addressing.
- Zcash , BLAKE2b for Equihash and other primitives.
- Filecoin, IPFS , alongside SHA-256 in multihash.
Internal structure
BLAKE2b borrows the G function from ChaCha (itself derived from Salsa20), arranged in a 4×4 grid of 64-bit words. Each round applies 8 G calls (column step then diagonal step). Twelve rounds keep BLAKE2b safe with comfortable margin while delivering ~1–3 GB/s on modern CPUs.
The HAIFA construction adds a counter and a final-block flag to each compression call. That extra context is what frees BLAKE2 from length-extension while keeping a single-pass streaming structure.
Try it
The multi-algorithm hasher includes BLAKE2b-512. The comparator shows its throughput against SHA-256, SHA-3-256, and BLAKE3 in this browser.
References
- RFC 7693 , The BLAKE2 Cryptographic Hash and MAC
- blake2.net , official site, spec, reference impls
- Aumasson, Neves, Wilcox-O’Hearn, Winnerlein , BLAKE2 paper (2013)
Visualize
BLAKE2b-512 on your input
11 bytes · 0-bit digest
Hex digest
Bit grid (0 bits, teal = 1, slate = 0)
Byte pixel art (0 bytes, hue = byte value mod 360°)
Avalanche , flipping the lowest bit of the first input byte changed 0 of 0 output bits