Did MD6 become SHA-3?

No. MD6 was one of 64 submissions to NIST's 2007-2012 SHA-3 competition, but Ron Rivest's team withdrew it before the second round after discovering their original speed and security-margin claims needed more rounds than initially proposed, which would have hurt its competition performance figures. Keccak went on to win and become SHA-3. MD6 was never broken or deprecated for a security flaw, it simply exited the competition on the design team's own initiative.

What makes MD6 different from earlier MD-family hashes?

Structurally almost everything. MD4, MD5, and MD2 are single-line Merkle-Damgard hashes that process one block after another sequentially. MD6 instead builds a 4-ary Merkle tree: the message is split into blocks, each block is compressed independently (so unrelated blocks can be hashed in parallel on separate cores), and the results are combined level by level up the tree until a single root value remains. It also supports arbitrary output lengths and an optional key, features none of Rivest's earlier MD designs had.

Why does this tool only offer MD6-256?

MD6 supports any output length from 1 to 512 bits, but 256-bit output is by far the most common choice in the few places MD6 shows up today, comparable to SHA-256 or BLAKE3's default output size. This tool fixes the output at MD6-256 (with MD6's default, fully hierarchical mode and no key) to keep the interface simple; the underlying algorithm is otherwise the unmodified standard.

Does this tool send my text to a server?

No. MD6 is computed entirely client-side using a pure JavaScript implementation, so nothing you type here is transmitted anywhere.

MD6 Hash Calculator - Calculate MD6-256 Checksum Online

Overview

Introduction

MD6 is Ron Rivest's 2008 entry in the NIST SHA-3 competition, a Merkle-tree-structured hash built for parallel computation and arbitrary output lengths, a sharp departure from the sequential, single-line design of his earlier MD4/MD5.

This tool computes MD6's 256-bit digest of any text you provide, entirely in your browser, using the algorithm's default parameters (unkeyed, fully hierarchical mode).

What Is MD6 Hash Calculator?

MD6 is a cryptographic hash function designed by Ronald Rivest and collaborators, submitted to NIST's SHA-3 competition in 2008, producing a digest shown here as 64 hexadecimal characters at its common 256-bit output size.

Rather than processing one sequential block after another, MD6 splits the message into 512-byte blocks, compresses each one independently at the bottom of a tree, then combines every four resulting chunks one level up, repeating until a single root chunk remains, a structure that naturally supports parallel computation and tunable tree depth.

How MD6 Hash Calculator Works

Your UTF-8 encoded input is split into 512-byte blocks (the last one zero-padded as needed) and each is compressed via MD6's 89-word-input, 16-word-output compression function, run for a number of rounds derived from the requested output length.

Each level's four-chunk groups get compressed again one level up the tree, cascading until only one 128-byte chunk remains; the last 256 bits of that final chunk become the hex-encoded digest this tool returns.

When To Use MD6 Hash Calculator

Use this when you specifically need to reproduce an MD6 digest, exploring the SHA-3 competition's design space, working with software that adopted MD6 despite it not becoming the standard, or comparing tree-based hash constructions against sequential ones.

For new general-purpose hashing needs, SHA-256, SHA-3, or BLAKE3 are the standard, far more widely supported choices; MD6 never became a standard and has minimal library support outside research contexts.

Often used alongside SHA-256 Hash Calculator and BLAKE3 Hash Calculator.

Features

Advantages

Naturally parallelizable Merkle-tree structure, unlike sequential Merkle-Damgard hashes.
Supports arbitrary output lengths (1 to 512 bits) and an optional key from a single unified design.
No known practical break; it exited the SHA-3 competition by its own designers' choice, not due to a discovered weakness.

Limitations

Never became a standard (Keccak won SHA-3), so it has far less library, hardware, and tooling support than SHA-2, SHA-3, or BLAKE3.
Significantly more complex to implement correctly than a sequential hash, given its tree construction and variable rounds/levels.
Practically irrelevant outside of specific legacy adopters or SHA-3-competition-era research and comparison work.

Examples

Hashing a short phrase

Input

md6 FTW

Output

7bfaa624f661a683be2a3b2007493006a30a7845ee1670e499927861a8e74cce

A single 7-byte input fits in one compression block, becoming the tree's only node and root at once.

Hashing the classic pangram

Input

The quick brown fox jumps over the lazy dog

Output

977592608c45c9923340338450fdcccc21a68888e1e6350e133c5186cd9736ee

Verified against Ron Rivest's own official MD6 reference implementation, compiled and run directly to confirm this value.

Best Practices & Notes

Best Practices

Use MD6 specifically to match or reproduce a value from a system that already relies on it, not as a new general-purpose default.
Remember this tool fixes MD6 at 256-bit output with default (unkeyed, fully hierarchical) parameters; a different output length or keyed mode will produce a different digest.
For new designs without a specific MD6 compatibility requirement, prefer SHA-256, SHA-3, or BLAKE3, all of which have far broader support.

Developer Notes

This tool ports Ron Rivest's official public-domain MD6 reference implementation (md6.hpp / md6_compress.cpp / md6_mode.cpp) to TypeScript using native BigInt 64-bit arithmetic, reproducing its exact Merkle-tree recursion, compression function, and padding. It's verified against that same reference implementation (compiled locally from source and run directly) across all four standard digest sizes, several block-boundary message lengths, and a 20000-byte message that exercises multi-level tree recursion, not just single-block inputs.

MD6 Hash Calculator Use Cases

Reproducing a known MD6 value while studying the SHA-3 competition's design space
Working with legacy software that specifically adopted MD6 before Keccak was selected as SHA-3
Comparing tree-based (parallel) hash construction against sequential Merkle-Damgard hashes on identical input
Confirming an MD6 implementation against a known-correct reference value

Common Mistakes

Assuming MD6 is SHA-3; it competed for that title but was withdrawn before the final rounds and is a distinct algorithm from the Keccak-based SHA-3 standard.
Expecting a match against another MD6 tool that uses a different output length, key, or tree-depth (L) parameter; all three change the resulting digest.
Choosing MD6 for a brand-new design without a specific compatibility reason, given its minimal real-world tooling support.

Tips

If you need a different MD6 output length or a keyed digest, note that this tool intentionally only exposes the common 256-bit, unkeyed, default-parameter configuration.
Use the SHA-256 or BLAKE3 tools alongside this one to compare a sequential and a tree-based/parallel hash on the same input.

MD6 Hash Calculator