Hash Identifier
Paste a hash and find out what probably made it. Some formats announce themselves in their prefix; the rest are narrowed by length and alphabet to a shortlist — and when two algorithms share a shape exactly, this page says so instead of picking one and sounding sure. It runs entirely in your browser: the hash is never uploaded, never logged and never sent anywhere to be cracked.
Reading a hash like a fingerprint examiner
Three features do nearly all the work. Prefix first: the modular crypt formats were designed to be self-describing, so $2y$ is bcrypt, $6$ is the SHA-512 password hash from a Linux shadow file, $argon2id$ is Argon2 with its tuning parameters riding along, and a leading asterisk marks MySQL’s post-4.1 format. When a prefix speaks, the identification is as certain as this field gets. Length second: a hex digest’s character count is twice its byte count, so 32 is 128-bit, 40 is 160-bit, 64 is 256-bit, 128 is 512-bit — each length is a family, not an individual. Alphabet third: pure hex suggests a raw digest; a string with + and / and trailing = is a digest wearing Base64, common when an API or a config file stores it.
The limits matter as much as the method, and they are the reason for the confidence labels. MD5 and NTLM are the famous collision: identical shape, different computation, and the only separator is provenance — where the string was found. SHA-256, SHA3-256 and BLAKE2s likewise share the 256-bit outline. Anyone who has asked an AI chat "what hash is this?" has met the failure mode: the chat picks the famous name for the length, states it flatly, and is wrong a third of the time with total confidence. This page returns the shortlist with the reasoning attached, so the human who knows the context — a Windows dump, a download page, a database column — can finish the identification the shape started. When you need to compute the digest of a candidate value to compare, use the hash generator; when the mystery string turns out to be encoded rather than hashed, the Base64 decoder will open it. The flagship article, never let a chatbot do your secrets, explains why all of this belongs on your own machine.
Frequently asked questions
Can a hash really be identified just by looking at it?
Partly — and the honest version of this tool says exactly how far "partly" goes. Some formats identify themselves: a bcrypt hash begins $2y$, a Linux shadow SHA-512 hash begins $6$, a MySQL 4.1 hash begins with an asterisk. Length narrows the rest: 64 hex characters is a 256-bit digest. But whole families share a shape, and no amount of staring separates them — which is why results here are labelled likely or possible, never certain.
Why can’t you tell MD5 from NTLM?
Because as strings they are the same object: 128 bits printed as 32 hex characters. The difference is entirely in how the digest was computed — NTLM is MD4 of the password in UTF-16 — and in where you found it. A 32-hex string in a Windows credential dump is NTLM; the same shape on a vendor’s download page is MD5. Context is the identifier; this tool gives you the candidate list and the clue to apply.
Does identifying a hash help crack it?
Identification is the dictionary definition of a preliminary step, not the deed. Knowing an algorithm tells you which tool and which attack mode apply; the hash still has to resist, and a bcrypt or Argon2 hash of a decent password will. This page deliberately does no cracking, no lookups and no rainbow-table queries — it reads a shape and explains it. If the hash is yours and you need the value behind it checked, generate the candidate passwords’ hashes with the hash generator and compare.
Is it safe to paste a hash here?
Safer than most places, with one caveat worth understanding. A hash is not the password — but a weak password’s hash pasted into a logged system (an AI chat, a ticket, a forum) can be taken away and attacked offline at leisure. This identifier runs entirely in your browser: nothing you paste is transmitted or stored, so the hash goes nowhere. Treat unknown hashes from a breach with the same care as the data they came with.
My hash has a salt or a label attached. Will it still match?
Only if the combined string still fits a known shape. Modular formats ($6$, $2y$, $argon2id$) carry their salt inside a recognised envelope, so they match. A home-grown format — hash, colon, salt, or a prefix a framework invented — will usually land on "unrecognised", and the result text says so rather than guessing. Strip it to the bare digest and try again; lengths are listed with each candidate to help.