Overview
Identifies the likely algorithm behind a hash string, such as MD5, SHA-1, SHA-256, SHA-512, bcrypt, Argon2, sha512crypt, phpass or NTLM, from its length, character set and prefix. Paste one hash or a list and each gets ranked candidates with confidence, hashcat mode numbers and John the Ripper format names. Nothing leaves your browser.
How It Works
Paste hashes one per line, up to 500 at a time. Prefixed formats such as $2y$, $argon2id$, $6$, $apr1$, {SHA} and pbkdf2_sha256$ are matched exactly and their parameters, like bcrypt cost or Argon2 memory, are read out. Plain hex strings are matched by length and list every algorithm that produces that many bits. A leading username and colon, as in an .htpasswd or shadow line, is ignored. The report can be copied or downloaded as text.
Step-by-Step Usage Guide
- Paste one or more hash strings, one per line.
- Read the summary for each line, which explains how it was matched.
- Check the ranked candidates and their confidence level.
- Note the hashcat mode or John format if you are testing your own password policy.
- Copy or download the report for your audit notes.
Technical Specifications & Standards
Most password storage formats announce themselves. Modular crypt strings start with an identifier: $1$ for md5crypt, $5$ and $6$ for sha256crypt and sha512crypt with optional rounds, $y$ for yescrypt, $2a$, $2b$ and $2y$ for bcrypt, and PHC strings such as $argon2id$v=19$m=19456,t=2,p=1$ carry their parameters in the text. Raw digests do not. A 32-character hex value is 128 bits, which fits MD5, NTLM and MD4 equally, and a 64-character value fits SHA-256, SHA3-256 and Keccak-256. In those cases the tool lists all of them, ranked by how common they are, and says plainly that only the system that stored the hash can settle it. Base64 strings are decoded to count bytes, so a 44-character value that decodes to 32 bytes is reported as a base64 SHA-256. UUIDs and JWTs are flagged as identifiers and tokens rather than hashes. A hash is a one-way function: this tool identifies formats for auditing your own systems and does not attempt to recover any input.
Targeted Use Cases
- Auditing a legacy database column to see whether passwords are stored as fast MD5 or SHA-1.
- Confirming a migration wrote bcrypt or Argon2id hashes with the intended cost parameters.
- Working out which hash a third-party API expects for a signature or checksum field.
- Sorting a CTF or training exercise dump into its hash types before analysis.
Notes & Gotchas
- Treat length-only matches as hints and confirm with the code or documentation of the source system.
- Plan to rehash anything stored as unsalted MD5, SHA-1 or SHA-256 with Argon2id or bcrypt on next login.
- Only analyse hashes from systems you own or are authorised to assess.
Frequently Asked Questions
How can I tell MD5 from NTLM?
From the string alone you cannot: both are 32 hex characters. NTLM hashes usually come from Windows credential stores and are often upper-case, while MD5 is common in web apps. The tool lists both and leaves the decision to context.
Can this tool reverse or decrypt a hash?
No. Hashes are one-way functions with no decryption step. The tool only identifies the format so you know how a value was produced and whether it meets current password storage guidance.
What do the hashcat mode numbers mean?
They are the -m values hashcat uses to select an algorithm, for example 0 for MD5, 1400 for SHA-256 and 3200 for bcrypt. They help you configure authorised password audits of your own systems.
Why is my UUID not identified as a hash?
A UUID is a random or time-based identifier, not a digest of any input, so it is flagged as not a hash. Use the UUID Validator to decode its version and timestamp.
Related tools
- Hash Generator - Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from any text — runs entirely offline.
- Bcrypt Hash & Verify - Hash passwords with bcrypt at configurable cost factors (4-31) and verify strings against existing bcrypt hashes — all in-browser.
- Scrypt / Argon2id Hasher - Modern password hashing with scrypt and Argon2id — configure memory, iterations, and parallelism for OWASP-compliant outputs.
- CRC Checksum Calculator - Calculate CRC-8, CRC-16, CRC-32, CRC-32C, and Adler-32 checksums for text and file inputs with hex and decimal output.
- File Type Detector (Magic Bytes) - Identify what a file really is from its magic bytes: 80+ formats including Office, EPUB, archives, media, fonts and executables, with MIME type, expected extensions, mismatch warnings and a hex preview.
- MIME Type Lookup - Search file extensions to find MIME types and vice versa — covers 800+ registered IANA media types with descriptions.