b3sum

b3sum is a command-line tool for computing BLAKE3 cryptographic hashes. BLAKE3 is a modern hash function that is simultaneously faster than MD5, SHA-1, SHA-256, and SHA-512, while also being cryptographically secure — making the usual tradeoff between speed and security irrelevant.

It is a drop-in replacement for tools like sha256sum and md5sum, with an identical interface and output format.

Features

• Extremely fast — outperforms MD5, SHA-1, SHA-256, and SHA-512 on modern hardware, often by a factor of 5–10×
• Parallel — exploits SIMD (AVX-512, AVX2, SSE4.1, NEON) and multi-threading automatically for large inputs
• Cryptographically secure — suitable for checksums, content addressing, MACs, key derivation, and PRFs
• Familiar interface — same usage pattern as sha256sum / md5sum, easy to drop into existing scripts
• Keyed mode — supports a 256-bit key for MAC (message authentication code) computation without a separate HMAC construction
• Derive-key mode — built-in key derivation function (KDF) for generating subkeys from a master key
• XOF mode — can produce an arbitrarily long output stream (extendable output function)

Installation

cargo install b3sum

Or via your system package manager:

# Arch Linux
pacman -S b3sum

# Debian / Ubuntu
apt install b3sum

# Fedora
dnf install b3sum

# macOS
brew install b3sum

# Nix
nix-env -iA nixpkgs.b3sum

Usage

# Hash a single file
b3sum file.txt

# Hash multiple files
b3sum file1.txt file2.txt file3.tar.gz

# Hash stdin
echo "hello world" | b3sum

# Output only the hash, no filename
b3sum --no-names file.txt

# Verify a file against a previously saved checksum
b3sum file.txt > file.txt.b3
b3sum --check file.txt.b3

# Produce a longer output (e.g. 64 hex bytes instead of the default 32)
b3sum --length 64 file.txt

# Keyed hashing (MAC) — key must be exactly 32 bytes
b3sum --keyed --key "$(head -c 32 /dev/urandom | xxd -p -c 32)" file.txt

# Key derivation — derive a subkey from a context string
b3sum --derive-key "myapp 2024-01-01 encryption key v1" < /dev/null

Speed comparison

On a modern x86-64 machine with AVX-512 support, BLAKE3 throughput for large inputs typically looks something like:

The exact numbers vary by hardware, but BLAKE3 is consistently the fastest option across all common platforms.

Use as a library

The blake3 Rust crate exposes the same algorithm for use in your own programs:

cargo add blake3

let hash = blake3::hash(b"hello world");
println!("{}", hash);

// Incremental hashing for streaming data
let mut hasher = blake3::Hasher::new();
hasher.update(b"hello ");
hasher.update(b"world");
let hash = hasher.finalize();

When to use BLAKE3

• File integrity checks — faster and more secure than MD5 or SHA-1
• Content addressing — ideal for content-addressed storage where you hash many files
• Password hashing — note: use a password hashing function like Argon2 instead; BLAKE3 is not designed to be slow
• MACs — use keyed mode instead of HMAC-SHA256 for better performance with equivalent security
• Key derivation — use derive-key mode to generate subkeys from a single master secret