Hash identifier — what kind of hash is this string?

How to use the hash identifier

1. Paste the hash into Hash. Leading and trailing spaces are ignored, and a 0x prefix on hex is allowed.
2. Read the table of Candidate algorithms and Why each one fits.
3. If several candidates are listed, the first is the most common for that length. Use context, such as where the hash came from, to decide.

What it does and when to use it

You may find a hash in a database column, a configuration file, an old backup or a security exercise without any note of how it was made. Knowing the algorithm tells you how to verify passwords against it, whether it needs upgrading, and which tool to use next. This page gives a quick first answer.

Once you know the type, the matching generator lets you test it, for example the MD5 generator or the bcrypt generator, which can verify a password against a bcrypt string. To check two hashes against each other, use the hash comparator.

How it works

The code checks three things in order:

1. Known prefixes. Regular expressions match self-describing formats. A bcrypt string must also have a two-digit cost and exactly 53 more characters. A prefix match is reported as certain.
2. Hex length. If the string is only hex digits, its length is looked up: 4 digits (CRC-16), 8 (CRC-32, Adler-32, FNV-1a 32 and others), 16, 32, 40, 56, 64, 96 or 128. Every common algorithm of that length is listed, the most common first. Hex digests are printed in one case, so a string that mixes upper and lower case and also fits a Base64 digest size, such as 64 characters for SHA-384, gets that Base64 reading first.
3. Base64 size. Otherwise, if it looks like Base64, the tool works out the decoded byte count and names the digest of that size, such as 32 bytes for SHA-256 or SHA3-256.

Anything else is reported as Unknown. Nothing is sent anywhere.

Worked examples

32 hex digits. 5f4dcc3b5aa765d61d8327deb882cf99 returns MD5 first (Most common 32-hex-digit (128-bit) digest), then NTLM, MD4, LM, RIPEMD-128 and XXH3-128. This particular value is the MD5 of the word “password”, which is why it is found in many leaked lists.

A bcrypt string. $2b$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW gives bcrypt | Certain: $2a$/$2b$/$2y$ prefix, cost and 22-character salt. The 12 is the cost factor.

Base64. ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0= decodes to 32 bytes, so the tool suggests SHA-256 / SHA3-256 (Base64). It is in fact the SHA-256 of abc.

Limits and tips

• Same-length digests cannot be told apart. A 64-digit hex value could be SHA-256, SHA3-256, Keccak-256, BLAKE2s, BLAKE3 or others.
• Truncated or salted custom formats, such as a hash with the salt appended after a colon, are not recognised.
• A Base64 string made only of hex characters in a single case, such as all lowercase, is still read as hex. Mixed case is read as Base64 first.