Hash Identifier: Detect the Algorithm from a Hash String

How to use the hash identifier

1. Copy the hash string you want to identify.
2. Paste it into the Hash string field above.
3. The hash identifier immediately lists matching algorithms ranked by likelihood.
4. Review the notes column for details about each candidate.

How the hash identifier works

A hash identifier determines the algorithm by examining three properties of the input string: its length, its character set and any structural prefix. For example, a 32-character string containing only hexadecimal digits (0 through 9 and a through f) is almost certainly an MD5 digest. A 64-character hex string points to SHA-256, while a 128-character hex string suggests SHA-512.

Prefixed hashes are even easier to classify. Strings starting with $2a$, $2b$ or $2y$ are bcrypt hashes. Those beginning with $argon2i$ or $argon2id$ use the Argon2 key derivation function. MySQL 4.1 and later stores password hashes with a leading asterisk (*) followed by 40 uppercase hex characters. The tool checks these patterns and lists up to the six most likely candidates, ranked by confidence, so you can evaluate the context yourself.

Common hash lengths reference

The table below lists standard output sizes for widely used hash functions. Length alone is not always enough to distinguish between algorithms that share the same digest size, but it narrows the field considerably.

Note that SHA-256 and SHA3-256 both produce 64 hex characters. When you encounter a 64-character hex string, additional context such as the application or system that generated it is needed to tell them apart. You can generate test values with the sha256 hash generator or sha3 hash generator to compare formats.

Prefixed and encoded hash formats

Many modern password storage schemes embed metadata directly in the hash string. These prefixes make identification straightforward for a hash identifier:

• bcrypt: Starts with $2a$, $2b$ or $2y$, followed by a two-digit cost parameter, another dollar sign, then 53 base64 characters. Example: $2b$12$WApznUPhDubN0oeveSXHp.xMUyQgk7k....
• Argon2: Starts with $argon2i$, $argon2d$ or $argon2id$, includes version, memory, time and parallelism parameters, a salt and the derived key, all separated by dollar signs.
• SHA-crypt: $5$ denotes SHA-256 crypt and $6$ denotes SHA-512 crypt, commonly found in Linux /etc/shadow files.
• NTLM: Exactly 32 hexadecimal characters, typically uppercase when displayed by Windows tools. It has no prefix, making it visually identical to an MD5 hash.
• MySQL: Version 4.1 and later uses an asterisk followed by 40 uppercase hex characters (a double SHA-1). Older MySQL versions used a 16-character hex string.

Ambiguity between hash types

Some algorithms produce outputs of the same length and character set, creating ambiguity. A 32-character hex string could be MD5, NTLM, or even a truncated representation of another algorithm. Similarly, a 40-character hex string might be SHA-1, RIPEMD-160, or the 40-character body of a MySQL 4.1 hash without its leading asterisk. When the hash identifier returns multiple candidates, consider where the hash came from. If it was extracted from a Windows SAM database, NTLM is far more likely than MD5. If it came from a Git commit, it is almost certainly SHA-1.

Base64-encoded hashes add another layer of complexity. A raw SHA-256 digest is 32 bytes, which encodes to 44 base64 characters including padding. Always check whether the input uses hex or base64 before drawing conclusions. Tools like the hash checker can verify a hash against a known plaintext once you have identified the algorithm.

Practical uses for identifying hashes

Security analysts, penetration testers and developers frequently encounter unlabeled hash strings in log files, database dumps, configuration files and network captures. Knowing the algorithm is the first step toward verifying integrity or auditing password storage practices. For instance, discovering that a web application stores passwords as unsalted MD5 hashes signals an urgent need to migrate to a stronger scheme like bcrypt or Argon2.

Developers integrating third-party APIs may receive hashed tokens without documentation specifying the algorithm. A quick check with a hash identifier clarifies what to expect. Forensic investigators also rely on hash identification when analyzing disk images or malware samples, where recognizing a specific digest format can reveal the tools or frameworks involved.

Worked examples