--- title: "Algorithms" description: "Every algorithm the package ships with its digest size and HMAC support and options. Read live from the registry" canonical_url: "https://hashes.agntn.dev/algorithms" --- # Algorithms > Every algorithm the package ships with its digest size and HMAC support and options. Read live from the registry Every row is `create(name).info()`, computed in your browser from the same registry the CLI and the agent tools read. Sort by digest to see what's 20 bytes and what's 64. The security note behind each row is the library's own, cut to its first clause. Hover it for the rest. ## Picking one For a new design, SHA-256 or BLAKE3 and move on. BLAKE3 when speed matters and you control both ends, SHA-256 when anything else has to agree with you. For compatibility, the page of the thing you're matching wins. Ethereum wants [Keccak-256](https://hashes.agntn.dev/algorithms/keccak256), not SHA3-256, and the two differ in one padding byte. A Bitcoin address wants [HASH160](https://hashes.agntn.dev/algorithms/hash160) of the key's bytes, not of its hex. The XRP Ledger wants [SHA-512Half](https://hashes.agntn.dev/algorithms/sha512-half), which isn't [SHA-512/256](https://hashes.agntn.dev/algorithms/sha512-256). Algorand wants the other one. Getting any of those almost right gives you a digest that looks exactly like the correct one. For checksums somebody else published, whatever they published, MD5 included. For your own tables and dedup, [xxHash](https://hashes.agntn.dev/algorithms/xxhash) or [FNV-1a](https://hashes.agntn.dev/algorithms/fnv1a). Never for anything an attacker gets to choose. For a password digest you need to reproduce, [scrypt](https://hashes.agntn.dev/algorithms/scrypt), [PBKDF2](https://hashes.agntn.dev/algorithms/pbkdf2) or [Argon2id](https://hashes.agntn.dev/algorithms/argon2id) with the exact salt and cost it was made with. [Salted KDFs](https://hashes.agntn.dev/guide/kdf) explains why the salt comes back. Keys from a secret that's already strong, a shared secret or a master key, come from [HKDF](https://hashes.agntn.dev/algorithms/hkdf) instead. Got a `U2FsdGVkX1` blob from `openssl enc` or CryptoJS? Its key and IV come from [EVP_BytesToKey](https://hashes.agntn.dev/algorithms/evp-bytestokey). ## Sitemap See the full [sitemap](https://hashes.agntn.dev/sitemap.md) for all pages.