diff --git a/doc/man/knsec3hash.1in b/doc/man/knsec3hash.1in
index 6af3fd9a199a805e20c3f13983423862e6debd8d..8579f3ed1e58620e3f102d8688be2f0fa8ac12d4 100644
--- a/doc/man/knsec3hash.1in
+++ b/doc/man/knsec3hash.1in
@@ -33,6 +33,8 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .SH SYNOPSIS
 .sp
 \fBknsec3hash\fP \fIsalt\fP \fIalgorithm\fP \fIiterations\fP \fIname\fP
+.sp
+\fBknsec3hash\fP \fIalgorithm\fP \fIflags\fP \fIiterations\fP \fIsalt\fP \fIname\fP
 .SH DESCRIPTION
 .sp
 This utility generates a NSEC3 hash for a given domain name and parameters of NSEC3 hash.
@@ -61,7 +63,7 @@ an error.
 .sp
 .nf
 .ft C
-$ knsec3hash c01dcafe 1 10 knot\-dns.cz
+$ knsec3hash 1 0 10 c01dcafe knot\-dns.cz
 7PTVGE7QV67EM61ROS9238P5RAKR2DM7 (salt=c01dcafe, hash=1, iterations=10)
 .ft P
 .fi
diff --git a/doc/man_knsec3hash.rst b/doc/man_knsec3hash.rst
index 3b4be45fca841961b5d76a20c6ea714516c9a2e2..f5deadde59477387cf689885a6b47dc2814edde0 100644
--- a/doc/man_knsec3hash.rst
+++ b/doc/man_knsec3hash.rst
@@ -8,6 +8,8 @@ Synopsis
 
 :program:`knsec3hash` *salt* *algorithm* *iterations* *name*
 
+:program:`knsec3hash` *algorithm* *flags* *iterations* *salt* *name*
+
 Description
 -----------
 
@@ -39,7 +41,7 @@ Examples
 
 ::
 
-  $ knsec3hash c01dcafe 1 10 knot-dns.cz
+  $ knsec3hash 1 0 10 c01dcafe knot-dns.cz
   7PTVGE7QV67EM61ROS9238P5RAKR2DM7 (salt=c01dcafe, hash=1, iterations=10)
 
 ::
diff --git a/src/utils/knsec3hash/knsec3hash.c b/src/utils/knsec3hash/knsec3hash.c
index 6a0244079b1d840557cbd44cc320da0d08560b43..b468d8b1479a5bacc6ef6cfafdbd929f8a4844d6 100644
--- a/src/utils/knsec3hash/knsec3hash.c
+++ b/src/utils/knsec3hash/knsec3hash.c
@@ -39,6 +39,8 @@ static void print_help(void)
 {
 	printf("Usage:   " PROGRAM_NAME " <salt> <algorithm> <iterations> <domain-name>\n");
 	printf("Example: " PROGRAM_NAME " c01dcafe 1 10 knot-dns.cz\n");
+	printf("Alternative usage: "PROGRAM_NAME " <algorithm> <flags> <iterations> <salt> <domain-name>\n");
+	printf("Example: " PROGRAM_NAME " 1 0 10 c01dcafe knot-dns.cz\n");
 }
 
 /*!
@@ -122,8 +124,12 @@ int main(int argc, char *argv[])
 		}
 	}
 
-	// knsec3hash <salt> <algorithm> <iterations> <domain>
-	if (argc != 5) {
+	bool new_params = false;
+	if (argc == 6) {
+		// knsec3hash <algorithm> <flags> <iterations> <salt> <domain>
+		new_params = true;
+	} else if (argc != 5) {
+		// knsec3hash <salt> <algorithm> <iterations> <domain>
 		print_help();
 		return EXIT_FAILURE;
 	}
@@ -135,11 +141,17 @@ int main(int argc, char *argv[])
 	dnssec_binary_t digest = { 0 };
 	dnssec_binary_t digest_print = { 0 };
 
-	if (!parse_nsec3_params(&nsec3_params, argv[1], argv[2], argv[3])) {
-		goto fail;
+	if (new_params) {
+		if (!parse_nsec3_params(&nsec3_params, argv[4], argv[1], argv[3])) {
+			goto fail;
+		}
+	} else {
+		if (!parse_nsec3_params(&nsec3_params, argv[1], argv[2], argv[3])) {
+			goto fail;
+		}
 	}
 
-	dname.data = knot_dname_from_str_alloc(argv[4]);
+	dname.data = knot_dname_from_str_alloc(argv[new_params ? 5 : 4]);
 	if (dname.data == NULL) {
 		error("Cannot parse domain name.");
 		goto fail;