What causes "hmac: %s is not a supported hash function" in gohugoio/hugo?

Use one of: md5, sha1, sha256, sha512 (lowercase) for HMAC.

hmac: is not a supported hash function

Error message

hmac: %s is not a supported hash function

What it means

`crypto.HMAC` (crypto.go:128-146) supports a smaller algorithm set than `crypto.Hash`: only `md5`, `sha1`, `sha256`, `sha512`. There is no `sha384` case, so requesting it (or any other string) hits the `default` arm and returns this error.

Solutions

Use one of: md5, sha1, sha256, sha512 (lowercase) for HMAC.
If you need sha384 HMAC, compute it in Go and expose the result.
Double-check the algorithm string against the documented HMAC set.

Example fix

// before
{{ crypto.HMAC "sha384" $key $msg }}
// after
{{ crypto.HMAC "sha256" $key $msg }}

Defensive patterns

Strategy: validation

Validate before calling

{{/* Valid HMAC algos: md5, sha1, sha256, sha512 (lowercase, no sha384) */}}
{{ crypto.HMAC "sha256" $key $msg }}

Prevention

HMAC supports fewer algos than Hash — no sha384.
Use lowercase algorithm names.
Document the HMAC-specific algorithm set in your project.

When it happens

Trigger: `{{ crypto.HMAC "sha384" $key $msg }}` (sha384 unsupported for HMAC), `{{ crypto.HMAC "SHA256" ... }}` (uppercase), or a typo.

Common situations: Assuming HMAC and Hash share the same algorithm list; using uppercase; requesting sha384 because `crypto.Hash` accepts it.

Related errors

AI-assisted analysis of gohugoio/hugo@52c9bd7908 (2026-08-09). Data as JSON: /api/errors/f6eab48afbe69865. Report an issue: GitHub.

Appendix: source

Thrown at tpl/crypto/crypto.go:145

// HMAC returns a cryptographic hash that uses a key to sign a message.
func (ns *Namespace) HMAC(h any, k any, m any, e ...any) (string, error) {
	ha, err := cast.ToStringE(h)
	if err != nil {
		return "", err
	}

	var hash func() hash.Hash
	switch ha {
	case "md5":
		hash = md5.New
	case "sha1":
		hash = sha1.New
	case "sha256":
		hash = sha256.New
	case "sha512":
		hash = sha512.New
	default:
		return "", fmt.Errorf("hmac: %s is not a supported hash function", ha)
	}

	msg, err := cast.ToStringE(m)
	if err != nil {
		return "", err
	}

	key, err := cast.ToStringE(k)
	if err != nil {
		return "", err
	}

	mac := hmac.New(hash, []byte(key))
	_, err = mac.Write([]byte(msg))
	if err != nil {
		return "", err
	}

View on GitHub (pinned to 52c9bd7908)