Cryptographic
BLAKE3
A successor to BLAKE2, released in 2020 by O’Connor, Aumasson, Neves, and Wilcox-O’Hearn. Built around a Merkle-tree of small BLAKE2-style compressions; the result is the fastest secure hash function on modern multi-core CPUs and a clean basis for streaming, parallel, and extendable-output use cases.
At a glance
| Output | Any length (default 256 bits) |
|---|---|
| Block size | 1024 bits |
| Construction | Binary Merkle tree of BLAKE2-style compressions |
| Rounds | 7 |
| Standard | None (community-driven, reference impl by the designers) |
| Collision security | 2128 at 256-bit output |
| Length extension | No |
| Status | Modern, recommended |
Three modes in one design
- Hashing , the default, plain content addressing.
- Keyed hashing , pass a 32-byte key to get a one-shot MAC, no HMAC needed.
- Key derivation ,
derive_key(context, input)uses an ASCII context string to domain-separate keys derived from the same input.
All three modes share the same compression function, distinguished by flag bits inside each node.
Why it is fast
- Tree structure , the input is split into 1024-byte chunks; each chunk and pair of chunks can be processed in parallel.
- SIMD-friendly compression, AVX-512, AVX2, NEON paths in the reference implementation easily reach 5–10 GB/s on commodity desktops.
- Only 7 rounds , far fewer than BLAKE2b (12), SHA-256 (64), or SHA-3 (24), made possible by the more conservative tree structure.
- Streaming or random-access, you can hash a 100 GB file in one streaming pass, or verify a specific 1 MB chunk in O(log n) tree-node hashes given the Merkle proof.
Built-in XOF
BLAKE3 produces unbounded output: after finishing the absorption tree, you can call finalize(N) for any N. The streaming property and the keyed-derivation mode make BLAKE3 a natural fit for KDFs (a replacement for HKDF in some new designs).
Where it is used
- Build systems , Bazel, Buck2, sccache use BLAKE3 for content addressing.
- Backup / sync tools , Restic, Kopia, IPFS optional.
- File transfer protocols , HTTP/3 content integrity drafts.
- Cryptocurrency , selectively; the conservative crypto crowd still leans toward SHA-256 / SHA-3 for asset hashes.
Security
BLAKE3’s round count is aggressive, justified by the tree structure and a margin smaller than SHA-3’s. No collision or preimage attack better than generic is known on full BLAKE3 at the time of writing. For ultra-conservative use, BLAKE2b or SHA-3 retain larger margins.
Try it
The multi-algorithm hasher includes BLAKE3-256. Run the comparatorto see BLAKE3’s throughput against SHA-256 and SHA-3-256.
References
- BLAKE3 specification (PDF)
- BLAKE3 reference implementation (Rust + C)
- Jack O’Connor , BLAKE3: One function, fast everywhere (talk)
Visualize
BLAKE3-256 on your input
11 bytes · 0-bit digest
Hex digest
Bit grid (0 bits, teal = 1, slate = 0)
Byte pixel art (0 bytes, hue = byte value mod 360°)
Avalanche , flipping the lowest bit of the first input byte changed 0 of 0 output bits
Quick quiz
Test yourself on blake3
10 multiple-choice questions. Pick an answer for each, then submit to see explanations.
Q1.What construction does BLAKE3 use?
Q2.How many rounds in the BLAKE3 compression function?
Q3.What year did BLAKE3 launch?
Q4.What is BLAKE3's chunk size?
Q5.Which mode of BLAKE3 is NOT in the standard?
Q6.Does BLAKE3 output a fixed-length digest?
Q7.Why can BLAKE3 verify a 1-MB chunk of a 100-GB file in O(log n) hash evaluations?
Q8.Which build system uses BLAKE3 for content addressing?
Q9.BLAKE3 versus BLAKE2b, which is faster on a multi-core desktop?
Q10.Does BLAKE3 require HKDF for key derivation?