Skip to main content
PPenTesting.org

Hash identifier: what type of hash is this?

Paste a hash and see which algorithm made it. The tool reads the hash's length, characters and format prefix, ranks the likely types, and lists every candidate when one shape fits more than one algorithm. It runs in your browser; nothing you paste leaves this page.

Try:

Enter a hash above to see likely types.

Identification is based on length, character set, and format prefix only — no hash is computed and nothing you paste leaves your browser. Shapes are shared across algorithms (for example MD5, NTLM and MD4 are all 32 hex characters), so several candidates can be equally valid.

MD5 · NTLM · MD432 hexSHA-1 · RIPEMD-16040 hexSHA-256 · SHA3-256 · BLAKE2s64 hexSHA-512 · SHA3-512 · Whirlpool128 hex
Length is the first clue. Several algorithms share each length, so the tool lists every candidate.

Common hash shapes

A quick reference for the shapes the identifier recognises. Length alone rarely pins down a single algorithm — the format prefix is what makes password hashes unambiguous.

ShapeLikely types
32 hex charactersMD5, NTLM, MD4 (identical length — ambiguous)
40 hex charactersSHA-1, RIPEMD-160
56 hex charactersSHA-224
64 hex charactersSHA-256, SHA3-256, BLAKE2s
96 hex charactersSHA-384
128 hex charactersSHA-512, SHA3-512, Whirlpool
$2a$ / $2b$ / $2y$ prefixbcrypt
$1$ / $5$ / $6$ prefixmd5crypt / sha256crypt / sha512crypt
$argon2id$ prefixArgon2

Hash identification, explained

How does a hash identifier work?

It inspects the structure of the string — its length, character set, and any format prefix — and matches that against the known shapes of common algorithms. It does not reverse or crack the hash; it only tells you what type it most likely is.

Why does it show more than one possible type?

Many algorithms produce output of the same shape. An MD5, an NTLM, and an MD4 hash are all 32 hexadecimal characters, so from the string alone they are indistinguishable. So the tool lists every plausible candidate rather than guessing one.

Can you tell MD5 and NTLM apart?

Not from the hash string alone — they are the same length and character set. Context is what separates them: an NTLM hash usually comes from a Windows credential store (for example an SAM dump or an ntds.dit export), while a bare MD5 typically comes from application data or a file checksum.

Is my hash sent to a server?

No. The identification runs entirely in your browser using JavaScript. Nothing you paste is transmitted, logged, or stored.

Can this crack or decode the hash?

No. Cryptographic hashes are one-way by design, so they cannot be decoded. Recovering the original value means guessing inputs and hashing them until one matches, which is what password-cracking tools do — this tool only identifies the type.

How to read the result

  • One clear match usually means a format prefix such as $2y$ (bcrypt) or $argon2id$. These are unambiguous.
  • Several matches means the shape is shared. A 32-character hex string can be MD5, NTLM or MD4, and the top of the list is the most common, not a certainty.
  • No match usually means the string is not a plain hash: it may be encoded (base64), salted with a separator, truncated, or not a hash at all.

Use where the hash came from to settle a tie. A Windows credential store points to NTLM; a web app database column points to MD5 or SHA-1.

$2y$10$salt and hash, then the end$2y$ means bcrypt10 is the cost setting: higher is slowerthe salt is stored inside the string
A prefix like this names the algorithm outright, so there is nothing to guess.

Common mistakes when identifying a hash

  • A trailing newline or space. Copying from a terminal often adds one. It changes the length and the match.
  • Base64 instead of hex. The same hash written in base64 is shorter and has different characters. Convert it to hex first.
  • Salt joined to the hash. Formats such as hash:salt need splitting before you paste.
  • Treating the guess as proof. Identification tells you the likely algorithm. Only the system that made the hash can confirm it.

If these are your own password hashes

The type matters because some algorithms are far too fast for passwords. OWASP's guidance is direct:

“Fast hashing algorithms such as SHA-256 are not suitable for password storage because they allow attackers to perform large numbers of guesses quickly.”

If the result is plain MD5, SHA-1 or SHA-256 for passwords, plan a move to a slow, salted algorithm such as Argon2id or bcrypt. Test how guessable your users' passwords are with the password strength checker, and ask a tester to review how credentials are stored as part of a penetration test.

Related tools and guides

Password strength checkerSee how fast a password could be guessed.JWT decoderRead a token header and claims in your browser.CVSS 3.1 calculatorScore a vulnerability with the v3.1 standard.Penetration testing servicesWhat a test covers and what to ask for before you buy.How to choose a penetration testing companyA buyer checklist for comparing UK providers.

Testing password storage for real?

A penetration test can check how your systems hash passwords. Compare UK penetration testing companies in our directory.

Browse the directory