Skip to main content
UFOZoo

SM3 Hash Calculator: Chinese National Crypto Standard

SM3 hash calculator online: China's national cryptographic hash standard GM/T 0004-2012 with 256-bit output, mandatory for government agencies.

Updated 2026-08-16

Related Tools

SHA-256 Hash Calculator: Bitcoin & HTTPS Standard Hash

Keccak-256 Hash: Ethereum Smart Contract Hash Online

Adler-32 Checksum: zlib & PNG Fast Integrity Check

Bcrypt Password Hash Generator: Online Hash & Verify Tool

BLAKE2b-256 Hash: Faster Than MD5, Secure as SHA-3

BLAKE2b-512 Hash: 512-bit High-Speed BLAKE2 Hash Online

Features

  • Compute SM3 hashes online: China's national cryptographic hash standard GM/T 0004-2012
  • Real-time 256-bit hash computation with 64 hex character output
  • One-click copy, save as .txt, and uppercase/lowercase toggle
  • Mandatory for Chinese government, banking, and public security systems
  • Hash verification against known SM3 checksums
  • Hash comparison: paste an expected 64-character SM3 hash alongside new output for instant match/mismatch verification
  • Real-time input length display: shows character and byte counts alongside the hash for development reference
  • Compute SM3 hashes on any device without installing Guomi crypto libraries
  • Session history: retains previous SM3 results during the session for comparing multiple integrity checks

How to Use

  1. 1Type or paste your text into the input box above.
  2. 2Your hash digest appears instantly. No page reload needed.
  3. 3Toggle UPPERCASE / lowercase to change the hex output format.
  4. 4Click the copy icon to copy the hash to clipboard, or use Save to save as .txt.
  5. 5Paste an expected hash into the Verify field to check for a match.
  6. 6How to verify SM3 compliance for Chinese government systems: compute SM3 hash of your data and compare against the expected checksum required by GB/T 32905 or GM/T 0004 standards documentation.
  7. 7How to generate SM3 hashes for financial system integration: when integrating with Chinese banking systems, compute SM3 hashes of transaction data to meet the mandatory Guomi cryptography requirements.
  8. 8How to compare SM3 with SHA-256 output: input the same text in both tools. Both produce 64-character hashes, but the outputs differ completely due to different compression functions.
  9. 9How to verify SM3 in TLS 1.3 connections: RFC 8998 defines SM2/SM3/SM4 cipher suites. Use this tool to generate SM3 hashes for certificate verification in Guomi-compliant TLS configurations.
  10. 10How to test SM3 implementation correctness: input known SM3 test vectors (from GM/T 0004 standard) and verify the output matches the expected hash to confirm correct implementation.

Frequently Asked Questions

What is SM3?

SM3 is China's national cryptographic hash standard (GM/T 0004-2012), published by the Chinese State Cryptography Administration. It produces 256-bit hashes and is a core component of the Guomi cryptographic suite alongside SM2 (public key) and SM4 (block cipher). It is mandatory for all Chinese government and financial systems. (See: GM/T 0004-2012)

How does SM3 compare to SHA-256?

SM3 and SHA-256 both produce 256-bit hashes and use Merkle-Damgard construction, but SM3 uses a different compression function with more complex message expansion (132 words vs 64). SM3 is generally considered to have a larger security margin but runs slightly slower than SHA-256. (See: GM/T 0004-2012)

Why does China have its own hash standard?

Like Russia (GOST) and other nations, China developed its own cryptographic standards to ensure technological sovereignty, avoid dependency on foreign algorithms, and address specific national security requirements.

Is SM3 recognized internationally?

SM3 has been submitted to ISO/IEC for international standardization. It is also recognized in TLS 1.3 through RFC 8998, which defines SM2/SM3/SM4 cipher suites for TLS connections, enabling international interoperability with Chinese cryptographic standards.

Should I use SM3 if I am not in China?

You may need SM3 if your software must interoperate with Chinese government systems, Chinese financial institutions, or comply with Chinese cybersecurity laws. For general-purpose applications outside China, SHA-256 or SHA-3 are more appropriate.

How many hex characters does SM3 produce?

SM3 produces a 256-bit hash displayed as 64 hexadecimal characters: the same output length as SHA-256.

Is SM3 secure?

Yes. SM3 has undergone extensive cryptanalysis since its publication in 2010. No practical attacks have been found. It is considered to have a security margin comparable to or slightly larger than SHA-256.

What is the Guomi (国密) suite?

Guomi (国密) is China's national cryptographic standard suite, consisting of SM2 (elliptic curve public key algorithm), SM3 (cryptographic hash), SM4 (block cipher), SM9 (identity-based cryptography), and others. SM3 is the hashing component of this suite.

Where is SM3 used in practice?

SM3 is used in Chinese government document signing, electronic ID cards, banking transaction verification, VPNs (via RFC 8998 TLS cipher suites), blockchain projects in China, and any system subject to the Chinese Cryptography Law.

Is SM3 faster than SHA-256?

SM3 is slightly slower than SHA-256 in most implementations due to its more complex message expansion (132 expanded words vs 64). The difference is typically 10-20% in software implementations.

Does SM3 support HMAC?

Yes, HMAC-SM3 is defined and used in some Chinese cryptographic protocols. It follows the standard HMAC construction with SM3 as the underlying hash function.

What output sizes does SM3 support?

SM3 always produces exactly 256-bit (64 hex character) output. Unlike some modern hashes (BLAKE2, SHA-3), SM3 does not support variable-length or extendable output.

Can SM3 be used for password hashing?

No, not directly. SM3, like SHA-256, is a fast hash designed for integrity, and the Chinese national standard suite has no deliberately slow password hash. Real-world Chinese systems typically use PBKDF2 with SM3 as the PRF and a high iteration count (10,000+), or a salt-and-iterate construction over SM3. If you are not bound by Guomi requirements, Argon2id or bcrypt is simpler and stronger. Never store passwords as a bare SM3 hash. Identical passwords would produce identical digests.

SM3 vs SM4: what's the difference? I keep mixing them up.

Different jobs in the Guomi suite: SM3 is a hash: a one-way 256-bit fingerprint with no key, used for integrity checks and inside SM2 signatures; SM4 is a block cipher: symmetric encryption with a 128-bit key, used to encrypt data in bulk. Easy way to remember: SM4 scrambles data so others can't read it; SM3 produces a checksum so you can tell if data changed. In a typical hybrid scheme: SM2 exchanges a key, SM4 encrypts the payload, SM3 verifies integrity.

Under Guomi compliance requirements, can I substitute SHA-256 for SM3?

No: when a regulation or contract mandates Guomi (国密), SHA-256 does not satisfy it. Chinese government, banking, and public security systems require SM2/SM3/SM4 (GM/T 0004, GB/T 32905) as a hard rule, and third-party audits check which algorithm was used, not just the security level. For any system not bound by those requirements, SHA-256 or SHA-3 is perfectly fine. When in doubt, ask the acceptance team which standard applies. Guessing wrong means failing certification.

SM3 and SHA-256 both output 64 characters, can I mix them when verifying?

No, never. Same length, completely different digests: SM3's compression function differs from SHA-256's, so the same input produces different hashes, and a checksum computed with one algorithm never matches the other. When you record a checksum, record the algorithm alongside it; if verification fails, the first thing to check is which algorithm the reference value was computed with. This is the single most common real-world SM3 verification mistake.