What causes "crypto.Hash: %q is not a supported hash algorithm" in gohugoio/hugo?

Use one of: md5, sha1, sha256, sha384, sha512 (lowercase).

crypto.Hash: is not a supported hash algorithm

Error message

crypto.Hash: %q is not a supported hash algorithm

What it means

Inside `newHash` (crypto.go:110-124), the algorithm string is matched against `md5`, `sha1`, `sha256`, `sha384`, `sha512`. Any other value reaches the `default` arm and returns this error quoting the unsupported algorithm. Note `sha384` is supported here but not in `crypto.HMAC`.

Solutions

Use one of: md5, sha1, sha256, sha384, sha512 (lowercase).
Drop the `crypto.Hash` algo arg entirely to use the sha256 default.
For unsupported algorithms, compute the hash in Go/JS and pass the result to the template.

Example fix

// before
{{ crypto.Hash "SHA-256" $value }}
// after
{{ crypto.Hash "sha256" $value }}

Defensive patterns

Strategy: validation

Validate before calling

{{/* Valid algos: md5, sha1, sha256, sha384, sha512 (lowercase) */}}
{{ crypto.Hash "sha256" $value }}
{{ crypto.Hash $value }} {{/* defaults to sha256 */}}

Prevention

Use lowercase algorithm names exactly as documented.
Remember sha384 is valid for Hash but not HMAC.
For sha3/blake2, compute in Go and pass the hex result.

When it happens

Trigger: `{{ crypto.Hash "sha3" $value }}`, `{{ crypto.Hash "SHA256" $value }}` (uppercase — matching is case-sensitive), or a typo like `sha-256`.

Common situations: Using uppercase algorithm names; requesting sha3/blake2 which Hugo does not bundle; copy-pasting an algorithm identifier from another tool's format.

Related errors

AI-assisted analysis of gohugoio/hugo@52c9bd7908 (2026-08-09). Data as JSON: /api/errors/1e4ca22677e26f8a. Report an issue: GitHub.

Appendix: source

Thrown at tpl/crypto/crypto.go:123

	}

	return hex.EncodeToString(h.Sum(nil)), nil
}

func newHash(algo string) (hash.Hash, error) {
	switch algo {
	case "md5":
		return md5.New(), nil
	case "sha1":
		return sha1.New(), nil
	case "sha256":
		return sha256.New(), nil
	case "sha384":
		return sha512.New384(), nil
	case "sha512":
		return sha512.New(), nil
	default:
		return nil, fmt.Errorf("crypto.Hash: %q is not a supported hash algorithm", algo)
	}
}

// HMAC returns a cryptographic hash that uses a key to sign a message.
func (ns *Namespace) HMAC(h any, k any, m any, e ...any) (string, error) {
	ha, err := cast.ToStringE(h)
	if err != nil {
		return "", err
	}

	var hash func() hash.Hash
	switch ha {
	case "md5":
		hash = md5.New
	case "sha1":
		hash = sha1.New
	case "sha256":
		hash = sha256.New

View on GitHub (pinned to 52c9bd7908)