Hash identifier
Paste a hash and find out what it most likely is. The tool ranks candidate algorithms by likelihood based on the hash's length, character set, and format — and it is honest when a shape maps to more than one algorithm. Everything runs in your browser; nothing you paste leaves this page.
Enter a hash above to see likely types.
Identification is based on length, character set, and format prefix only — no hash is computed and nothing you paste leaves your browser. Shapes are shared across algorithms (for example MD5, NTLM and MD4 are all 32 hex characters), so several candidates can be equally valid.
Common hash shapes
A quick reference for the shapes the identifier recognises. Length alone rarely pins down a single algorithm — the format prefix is what makes password hashes unambiguous.
| Shape | Likely types |
|---|---|
| 32 hex characters | MD5, NTLM, MD4 (identical length — ambiguous) |
| 40 hex characters | SHA-1, RIPEMD-160 |
| 56 hex characters | SHA-224 |
| 64 hex characters | SHA-256, SHA3-256, BLAKE2s |
| 96 hex characters | SHA-384 |
| 128 hex characters | SHA-512, SHA3-512, Whirlpool |
| $2a$ / $2b$ / $2y$ prefix | bcrypt |
| $1$ / $5$ / $6$ prefix | md5crypt / sha256crypt / sha512crypt |
| $argon2id$ prefix | Argon2 |
Hash identification, explained
How does a hash identifier work?
It inspects the structure of the string — its length, character set, and any format prefix — and matches that against the known shapes of common algorithms. It does not reverse or crack the hash; it only tells you what type it most likely is.
Why does it show more than one possible type?
Many algorithms produce output of the same shape. An MD5, an NTLM, and an MD4 hash are all 32 hexadecimal characters, so from the string alone they are indistinguishable. The tool is honest about this and lists every plausible candidate rather than guessing one.
Can you tell MD5 and NTLM apart?
Not from the hash string alone — they are the same length and character set. Context is what separates them: an NTLM hash usually comes from a Windows credential store (for example an SAM dump or an ntds.dit export), while a bare MD5 typically comes from application data or a file checksum.
Is my hash sent to a server?
No. The identification runs entirely in your browser using JavaScript. Nothing you paste is transmitted, logged, or stored.
Can this crack or decode the hash?
No. Cryptographic hashes are one-way by design, so they cannot be decoded. Recovering the original value means guessing inputs and hashing them until one matches, which is what password-cracking tools do — this tool only identifies the type.
Testing password storage for real?
Weak or fast hashing (unsalted MD5, plain SHA-1) is a finding a penetration test will surface. Compare independent, accreditation-verified UK penetration testing companies in our directory.
Browse the directory