gohugoio/hugo · error

crypto.Hash: %q is not a supported hash algorithm

Error message

crypto.Hash: %q is not a supported hash algorithm

What it means

When `crypto.Hash` is given an algorithm name, `newHash` maps it to a Go hash constructor. Only `md5`, `sha1`, `sha256`, `sha384`, and `sha512` are supported; any other string (including casing or naming variants like `SHA-256`) falls through to this error.

Source

Thrown at tpl/crypto/crypto.go:123

	}

	return hex.EncodeToString(h.Sum(nil)), nil
}

func newHash(algo string) (hash.Hash, error) {
	switch algo {
	case "md5":
		return md5.New(), nil
	case "sha1":
		return sha1.New(), nil
	case "sha256":
		return sha256.New(), nil
	case "sha384":
		return sha512.New384(), nil
	case "sha512":
		return sha512.New(), nil
	default:
		return nil, fmt.Errorf("crypto.Hash: %q is not a supported hash algorithm", algo)
	}
}

// HMAC returns a cryptographic hash that uses a key to sign a message.
func (ns *Namespace) HMAC(h any, k any, m any, e ...any) (string, error) {
	ha, err := cast.ToStringE(h)
	if err != nil {
		return "", err
	}

	var hash func() hash.Hash
	switch ha {
	case "md5":
		hash = md5.New
	case "sha1":
		hash = sha1.New
	case "sha256":
		hash = sha256.New

View on GitHub ↗ (pinned to 8a468df065)

Solutions

1. Use one of the exact lowercase names: md5, sha1, sha256, sha384, or sha512.
2. Normalize the name, e.g. `{{ crypto.Hash (lower (replace $algo "-" "")) $v }}` if it comes from data.
3. Verify argument order: algorithm first, value second — `crypto.Hash "sha256" $v`.

Example fix

<!-- before -->
{{ crypto.Hash "SHA-256" $content }}
<!-- after -->
{{ crypto.Hash "sha256" $content }}

{{ $algo := "sha256" }}
{{ if in (slice "md5" "sha1" "sha256" "sha512") $algo }}{{ crypto.Hash $algo .Content }}{{ else }}{{ errorf "unsupported hash %q" $algo }}{{ end }}

When it happens

Trigger: `{{ crypto.Hash "sha3" $v }}`, `{{ crypto.Hash "SHA256" $v }}`, `{{ crypto.Hash "sha-256" $v }}`, `{{ crypto.Hash "blake2b" $v }}` — anything not exactly one of the five lowercase names; also accidentally passing the value as the first of two args so the content string is treated as the algorithm.

Common situations: Using uppercase or hyphenated algorithm names copied from SRI attributes (`sha384-...`) or other tools; expecting algorithms Hugo doesn't ship (sha3, blake2, crc32); swapping argument order so the data lands in the algorithm slot.

Related errors

• crypto.Hash: expected 1 or 2 arguments, got %d
• hmac: %s is not a supported hash function
• %q is not a supported encoding method
• error building site: %w
• failed to detect format from content

AI-assisted analysis of gohugoio/hugo@8a468df065 (2026-07-31). Data as JSON: /data/errors/1e4ca22677e26f8a.json. Report an issue: GitHub ↗.