Hash Identifier

About this tool

A hash is a fixed-length fingerprint of data, and many look alike: a 32-character hexadecimal string might be MD5, NTLM, MD4 or something rarer. This tool narrows down the possibilities from three things you can see: the length, the characters used, and any prefix. Password hash formats carry a recognisable prefix: bcrypt starts with $2b$ and a cost, Argon2 with $argon2id$, md5crypt with $1$, SHA-256 and SHA-512 crypt with $5$ and $6$, phpass (WordPress) with $P$, Django with pbkdf2_sha256$, LDAP with {SSHA}, MySQL with an asterisk. Plain digests are recognised by length: 32 hexadecimal characters, 40, 56, 64, 96 or 128, as well as base64 versions. Each candidate is rated high, medium or low and shown with its hashcat mode number where there is one, which is handy when you test your own systems. The results are guesses: nothing can prove which algorithm made a bare hash, and a salted or truncated value can fool any identifier. The rules were checked with 168 real hashes made by Python's hashlib and passlib across about 40 schemes, and compared with the hashid tool. The hash never leaves your browser. Use it only on hashes you are allowed to examine.

How to use it

1. Paste one hash, without extra spaces or quotes.
2. Read the candidates from the most likely down.
3. Use the note and the context (where the hash came from) to choose between look-alikes.
4. If you are auditing your own system, move weak hashes (MD5, SHA-1, unsalted) to bcrypt or Argon2.

Common problems

It lists many algorithms for my 32-character hash

That is expected: MD5, NTLM and others all produce 32 hexadecimal characters. The system the hash came from tells you which is right.

Nothing matches my hash

It may be encrypted or encoded data, a token, a salted format with a custom layout, or a hash of an unusual kind. Check for a prefix or separators.

Can this tool crack the hash?

No. It only suggests the type. It does not recover passwords.