Hash Identifier

A tool that analyzes a hash string and lists candidate algorithms (MD5, SHA-1, SHA-256, bcrypt, Argon2, PBKDF2, JWT, and more) based on length, character set, and prefixes.

Yes — all detection is client-side regex pattern matching. Your hashes never leave your device.

Many hashes are indistinguishable (e.g. MD5, NTLM, MD4, LM all emit 32 hex chars). Results are ranked by confidence with the corresponding Hashcat mode number.

Yes, the Hash Identifier is 100% free with no registration, no hidden fees, and no usage limits. All processing happens locally in your browser, ensuring complete privacy.

Absolutely. The Hash Identifier processes everything client-side in your browser. No data is uploaded to or stored on any server. Your content remains private on your device at all times.

Yes, the Hash Identifier is fully responsive and works on smartphones and tablets. You can use it on any device with a modern web browser -- no app download required.

No account or registration is needed. Simply open the Hash Identifier in your browser and start using it immediately. There are no sign-up walls or usage restrictions.

Simply enter your input in the provided field, adjust any settings to your preference, and the tool will process it instantly. You can then copy the result to your clipboard or download it.

The Hash Identifier works in all modern browsers including Chrome, Firefox, Safari, Edge, and Opera. For the best experience, use the latest version of your preferred browser.

You usually can't from the digest alone, and that is the honest answer most tools won't give you. Both MD5 and NTLM produce a 32-character hexadecimal string, because NTLM is essentially an unsalted MD4 of the UTF-16 password and shares the same 128-bit length. MD2, MD4, LM, RIPEMD-128 and HAVAL-128 also land at 32 hex characters, so they are mathematically indistinguishable by shape. The deciding factor is context: a 32-hex value pulled from a Windows SAM database or a domain controller dump is almost certainly NTLM, while one from a web application's user table is more likely MD5. This tool lists every plausible 32-hex candidate ranked by confidence with each one's Hashcat mode, so you can pick the right algorithm based on where the hash came from. Paste your hash above to see the full candidate list.

A Hashcat mode is the numeric value you pass to Hashcat's -m flag to tell it exactly which algorithm to crack. Hashcat supports hundreds of formats, and each has its own mode: MD5 is -m 0, SHA-1 is -m 100, SHA-256 is -m 1400, bcrypt is -m 3200, SHA-512 crypt is -m 1800, and JWT is -m 16500. Picking the wrong mode means Hashcat compares your wordlist against the wrong algorithm and never finds a match, so getting this number right is the first practical step in any cracking attempt. This identifier prints the matching mode beside every candidate it recognizes, so instead of hunting through Hashcat's mode list you can copy the value straight into your command. Note that purely informational formats like MD2 or Adler-32 show no mode because Hashcat does not target them.

The difference is whether the algorithm is written into the string itself. Adaptive password hashes like bcrypt, Argon2, and the Unix crypt variants use structured formats that embed metadata as prefixes: bcrypt always starts with $2a$, $2b$, or $2y$ followed by a cost factor and a 53-character tail, while Argon2 begins with $argon2id$ or $argon2i$ and lists its memory and iteration parameters. Those markers make identification unambiguous, not a guess. A raw SHA-256 digest, by contrast, is just 64 hexadecimal characters with no embedded clues, and SHA3-256 and BLAKE2s-256 share that exact length. So the tool reports salted and prefixed formats as high confidence and raw hex digests as a ranked best guess. Paste any hash to see which category yours falls into and how certain the match is.

A JSON Web Token has a distinctive structure: three Base64URL-encoded segments joined by dots in the form header.payload.signature. The identifier first checks for exactly three dot-separated parts that each contain only valid Base64URL characters, which rules out ordinary hashes. But many random strings could technically match that pattern, so the tool goes a step further and actually decodes the first segment, then confirms the resulting JSON header contains an alg field declaring the signing algorithm. A token that decodes to a real header with alg present scores high confidence, while something that only resembles the shape scores lower. This matters because JWTs are not password hashes but signed tokens, and the signature uses its own Hashcat mode, -m 16500. Paste a token to confirm it is a genuine JWT before you try to attack its signature.

A no-match result almost always means the input is slightly malformed rather than an unknown algorithm, and a few quick checks usually fix it. First, strip stray whitespace, line breaks, or quotation marks that were copied along with the hash, since detection trims the value but cannot guess past leading or trailing junk. Second, confirm the string is complete: a truncated prefix like a missing $2a$ on a bcrypt hash, or a dropped character that breaks the expected length, will defeat pattern matching. Third, watch for non-hex characters such as a stray g or a smart-quote that snuck in during copy-paste. If you are pasting a batch, the Bulk tab flags each line individually so you can spot the one that failed. Clean the value and paste it again, and the tool will re-run detection instantly.