Hash Identifier
Paste a single hash and the tool guesses which algorithm produced it. It first checks for tell-tale prefixes like bcrypt's $2y$ or the Unix crypt $6$, and if none match it falls back to character set and length to rank candidates such as MD5, SHA-1, and SHA-256. Every guess carries a high, medium, or low confidence badge because many algorithms share the same output shape.
How to identify a hash
- Paste one hash into the box, or click an MD5, SHA-256, or bcrypt example button.
- Enter only the hash itself, without a label, quotes, or trailing spaces.
- Read the ranked list of likely algorithms, ordered high to low confidence.
- Check the confidence badge and any note under each candidate for context.
- Click 'Copy names' to copy the candidate list for use in a cracking or audit tool.
Examples
MD5 hash (32 hex characters)
5f4dcc3b5aa765d61d8327deb882cf99
MD5 (high), NTLM (medium), MD4 (low), MD2 (low)
SHA-256 hash (64 hex characters)
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA-256 (high), SHA3-256 (low), BLAKE2s-256 (low)
bcrypt hash (recognized by its prefix)
$2y$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
bcrypt (high)
Frequently asked questions
Is my hash sent to a server?
No. Identification runs entirely in your browser using JavaScript, so the hash you paste never leaves your device. That matters when a hash comes from a password database or another sensitive source.
How does the detection actually work?
It is purely heuristic. The tool first looks for known prefixes such as $2y$ for bcrypt, $6$ for SHA-512 crypt, or {SSHA} for LDAP. If none match and the string is all hexadecimal, it maps the length to a list of algorithms that produce that many characters.
Can it ever be certain about the algorithm?
Only for prefixed formats like bcrypt, Argon2, or Unix crypt, where the leading characters uniquely name the scheme. For a plain hex string it can only rank possibilities, because length and character set do not uniquely identify the algorithm.
Can it tell MD5 from NTLM?
Not from the hash alone. Both are 32 hexadecimal characters, so they are indistinguishable by format. The tool ranks MD5 as high because it is far more common and lists NTLM as a medium-confidence alternative for you to consider.
Why do I get several candidates for one hash?
Many algorithms share an output length. A 64-character hex string could be SHA-256, SHA3-256, or BLAKE2s-256, so the tool shows every plausible match ordered by likelihood rather than guessing a single answer.
What if I get 'Unknown' or 'No match'?
That means the string did not match a known prefix and its length and character set did not line up with a common raw hash. Salted formats, base64 output, truncated hashes, or extra whitespace can all cause this. Trim the value and paste just the hash.
Does it work on salted or encoded hashes?
Partly. It recognizes several salted formats that carry a standard prefix, such as bcrypt, Unix crypt, and LDAP SSHA. A raw hash with a separate salt, or one encoded as base64 rather than hex, will often come back as Unknown.
Does identifying a hash let me reverse it?
No. Cryptographic hashes are one-way, so knowing the algorithm only tells you how a value was produced, not the original input. Recovering the input still requires guessing candidates and hashing them, which is what password cracking tools do.
Can I identify several hashes at once?
No, it analyzes one hash at a time. Paste a single value; multiple lines or a labeled entry will usually fail to match. For bulk work, feed the algorithm guess into a dedicated tool like hashcat or John the Ripper.
Learn more
- How hash identification works, and its limits
Why a hash type can be narrowed but rarely proven from the string alone, covering prefixes, length maps, and where the guess fails.
Related tools
Reverse Shell Generator
Generate reverse shell one-liners for Bash, Python, PHP, Perl, Ruby, PowerShell, Netcat and Socat from an IP and port, plus the listener command.
Hash Generator
Generate SHA-1, SHA-256, SHA-384 and SHA-512 hashes from any text. Live, lowercase hex output that runs entirely in your browser.
HMAC Generator
Generate an HMAC for a message and secret key with SHA-1, SHA-256, SHA-384 or SHA-512. Verify webhook and API signatures, with hex or base64 output.
JWT Decoder
Decode a JSON Web Token to read its header and payload claims. Shows exp, iat and nbf as dates. Runs in your browser. No signature check.
AES Encryption
Encrypt and decrypt text with AES-GCM and a password. Uses 256-bit keys derived with PBKDF2, runs entirely in your browser, and nothing is uploaded.
CSP Analyzer
Paste a Content-Security-Policy header and get it parsed into directives and audited for weaknesses, with severity and fixes. Runs in your browser.