Hash Identifier
Paste a hash and find out what type it is. This tool reads a value's length, character set and structural markers — like the $2b$ of bcrypt or the {SSHA} of an LDAP hash — and returns a ranked best-guess of the likely algorithms, honest about where formats overlap. A defensive/forensics aid; everything runs in your browser and nothing is uploaded.
Paste a hash and press Identify. Identification is based on length, character set and structural markers — a ranked best-guess, not a definitive answer.
Everything is classified in your browser — the hash is never uploaded or sent anywhere. This is a defensive/forensics aid (incident response, password-storage auditing, triaging a credential dump you are authorised to handle). It identifies a format; it does not crack, reverse or look up hashes.
What this tool is
- Paste any hash and get a ranked, best-guess list of what type it is — with the reason each candidate matched and an honest note on ambiguity.
- Recognises raw digests by length (MD5, SHA-1, SHA-224/256/384/512), Windows NTLM, and structurally-marked password hashes: bcrypt ($2b$), md5crypt/sha256crypt/sha512crypt ($1$/$5$/$6$), Argon2, PBKDF2, scrypt, yescrypt, LDAP {SHA}/{SSHA}, MySQL, Django, phpass and Cisco types.
- Reads credential-dump structures too — pwdump “user:RID:LM:NT:::” lines and LM:NTLM pairs — and Base64-encoded raw digests.
- Identification is by FORMAT, so it is a best-guess, never proof: a 32-hex value could be MD5, NTLM or MD4; the system that produced the hash is the real tell.
- A defensive / forensics aid — incident response and password-storage auditing. Everything runs client-side; the hash is never uploaded, cracked or looked up.
How hash identification works
You cannot "decode" a hash to learn what made it — a cryptographic hash is one-way. What you can do is recognise its format. Three signals carry nearly all of the information, and this tool uses all three.
1. Length & character set
A bare digest is just hexadecimal, and its length pins down the bit size. The common widths:
- 32 hex (128-bit) — MD5, MD4 or NTLM (they are identical in shape).
- 40 hex (160-bit) — SHA-1 or RIPEMD-160.
- 56 hex (224-bit) — SHA-224 / SHA3-224.
- 64 hex (256-bit) — SHA-256 (or SHA3-256 / Keccak-256 / BLAKE2s).
- 96 hex (384-bit) — SHA-384 / SHA3-384.
- 128 hex (512-bit) — SHA-512 (or SHA3-512 / BLAKE2b / Whirlpool).
A value can also be Base64 rather than hex — then the decoded byte count gives the size (24 Base64 chars ending == → 16 bytes → MD5/NTLM; 28 → 20 bytes → SHA-1; 44 → 32 bytes → SHA-256).
2. Structural markers (prefixes)
Password hashes are the easy case: they carry a self-describing prefix in Modular Crypt Format or a directory tag, which is a definitive marker rather than a guess.
$2a$ / $2b$ / $2y$→ bcrypt (the two digits after are the cost).$1$ / $5$ / $6$→ md5crypt / sha256crypt / sha512crypt.$argon2id$,$scrypt$,$y$→ Argon2 / scrypt / yescrypt.{SHA} / {SSHA}→ LDAP (RFC 2307) SHA-1, salted or not.
3. Delimiters & layout
A colon-separated line like user:RID:LMhash:NThash::: is a Windows pwdump credential dump (two 32-hex fields — the LM and NTLM hashes); a plain hash:salt pair is a salted digest; and algorithm$iterations$salt$hash is a Django hash. The empty-LM constant aad3b435b51404eeaad3b435b51404ee is itself a reliable sign you are looking at an NTLM dump.
The important caveat: it is a best-guess
Identification by format is inherently a best-guess, not proof. Many distinct algorithms share a representation — MD5 and NTLM are both 32 hex characters, SHA-224 and SHA3-224 are both 56, SHA-512 and SHA3-512 and BLAKE2b are all 128 — and no bit of the string tells them apart. The real disambiguator is context: the system that produced the hash. An NTLM hash comes out of a Windows SAM/NTDS dump; an MD5 checksum sits beside a file. Structurally-marked password hashes are the exception — a $6$ or $2b$ prefix is unambiguous — which is why this tool reports those with high confidence and the bare digests more cautiously.
Defensive use only. This is a forensics and auditing aid — for incident response, triaging a credential dump you are authorised to handle, or checking how a system stores passwords (e.g. confirming a legacy app still uses unsalted MD5 so you can prioritise the fix). It only identifies a format: it does not crack, reverse, brute-force or look up hashes, and nothing you paste leaves your browser. Do not use it to attack data you do not own.
Frequently asked questions
How does hash identification actually work?
A hash is just a string, so identification is pattern-matching on its shape, not decryption. Three signals carry almost all the information. First, length and character set: a value that is exactly 32 hexadecimal characters is a 128-bit digest (MD5, NTLM, MD4…), 40 hex is 160-bit (SHA-1, RIPEMD-160), 64 hex is 256-bit (SHA-256), and so on. Second, structural markers: password hashes written in Modular Crypt Format announce themselves with a prefix — $2b$ is bcrypt, $6$ is sha512crypt, $argon2id$ is Argon2 — and directory formats wrap the digest in a tag like {SSHA}. Third, delimiters and layout: a colon-separated line such as user:RID:LMhash:NThash::: is a pwdump credential dump, and algorithm$iterations$salt$hash is a Django hash. This tool applies all three and returns the candidates that fit, ranked by likelihood.
Why does it show several possible types instead of one answer?
Because format alone genuinely cannot tell many algorithms apart. The clearest example: MD5 and NTLM are both 128-bit, so both render as exactly 32 hexadecimal characters — there is no bit in the string itself that distinguishes them. The same is true of SHA-224 vs SHA3-224, or SHA-512 vs SHA3-512 vs BLAKE2b, which share a length. Any tool that gives you a single confident answer for a bare hex digest is guessing and hiding the guess. We show the ranked set and tell you the real disambiguator is context: an NTLM hash comes out of a Windows SAM or NTDS.dit dump, an MD5 checksum sits next to a download, and so on. Structurally-marked hashes (bcrypt, sha512crypt, Argon2, LDAP) are the exception — their prefix is a definitive marker, so those are reported with high confidence.
Can this tool crack a hash or reveal the original password?
No, and that is deliberate. It only classifies the format — it does nothing to reverse, brute-force, look up, or submit the value anywhere. A cryptographic hash is one-way by design; recovering the input means guessing candidates and hashing them, which is cracking, not identification, and is not what this tool is for. The whole thing runs client-side in your browser with no network calls, so the hash you paste is never transmitted. Use it to understand what you are looking at — for example, to confirm a legacy system is storing passwords as unsalted MD5 so you can prioritise migrating it — not to attack data you do not own.
What is the difference between a fast digest and a password hash?
A plain digest like MD5, SHA-1 or SHA-256 is designed to be fast — that is exactly what you want for file integrity and signatures, and exactly what you do NOT want for stored passwords, because fast means an attacker can test billions of guesses per second against a stolen hash. Password hashes such as bcrypt, scrypt, Argon2 and the sha512crypt ($6$) family are deliberately slow and salted, with a tunable work factor baked into the string (the cost after $2b$, the rounds= in a crypt hash, the m=/t=/p= in Argon2). If this tool tells you stored credentials are bare SHA-256 or MD5 rather than one of those adaptive schemes, that is a finding worth acting on. For new systems, Argon2id or bcrypt are the standard recommendations.
A 32-character hex string: is it MD5 or NTLM?
From the string alone you cannot be certain — both are 128-bit and both are 32 hexadecimal characters. The deciding factor is provenance. If the value came from a Windows credential dump (pwdump, secretsdump, the NTDS.dit of a domain controller), especially paired as LM:NT or in a user:RID:LMhash:NThash::: line, it is an NTLM hash. If it sits beside a file download, a database column of “md5 checksums”, or a legacy web-app user table, it is almost certainly MD5. One structural hint: in a pwdump line the empty LM hash is the constant aad3b435b51404eeaad3b435b51404ee, which is a reliable NTLM-dump signature. This tool surfaces both candidates and the context clues rather than pretending to know which one it is.