BLAKE2 derives from the SHA-3 finalist BLAKE and uses a HAIFA-style iteration that resists length extension. It has built-in keying (a MAC mode without HMAC), salt and personalization parameters, and tree-hashing variants. Test vector: BLAKE2b-512 of the empty string starts 786a02f742015903.
It shows up in Argon2 (the RFC 9106 password hash uses BLAKE2b internally), WireGuard (BLAKE2s for hashing and as a MAC), PASETO v4 local tokens (keyed BLAKE2b as the MAC; v2 uses it to derive nonces), libsodium's crypto_generichash, Zcash and many content-addressed stores. BLAKE3 (2020) is a separate, faster tree-based successor with its own specification.
BLAKE2 is not a NIST-approved hash, so FIPS-validated modules cannot use it for approved services. In software without hash instructions it is typically faster than SHA-256, but on CPUs with SHA extensions the advantage reverses: on one Apple M4 Max core, OpenSSL 3.6.5 hashes BLAKE2b-512 at about 1.27 GB/s and SHA-256 at 2.85 GB/s.