Hash Identifier & Analyzer
Identify and analyze hash types from hash strings. Supports MD5, SHA-1, SHA-2, SHA-3, bcrypt, Argon2, scrypt, PBKDF2, and more. Analyzes hash format, length, and characteristics to determine the most likely hashing algorithm used.
Input
Supports 100+ hash types plus JWT, pwdump/NTDS lines, and wallet addresses. Identification runs automatically as you type.
No hash on hand? Load an example
Analysis Results
Analysis results will appear here
Start typing a hash above — or load a sample.
How Hash Identification Works
- • Length Analysis: Different algorithms produce different output lengths
- • Format Recognition: Structured hashes (bcrypt, Argon2, PBKDF2) have distinctive formats
- • Pattern Matching: Character patterns help distinguish between algorithms
- • Confidence Levels: Higher confidence when format is unique to one algorithm
- • Multiple Matches: Some lengths match multiple algorithms (disambiguation needed)
- • Hashcat & John: Each candidate maps to a Hashcat
-mmode and, where one exists, a John the Ripper--format=name
Supported Hash Types (100+)
Cryptographic Hashes:
- • MD2, MD4, MD5 (deprecated)
- • SHA-1 (deprecated)
- • SHA-224, SHA-256, SHA-384, SHA-512
- • SHA3-224/256/384/512 (17300–17600)
- • Keccak-224/256/384/512 (17700–18000)
- • BLAKE2b, BLAKE2s, BLAKE3
- • RIPEMD-160, Whirlpool, Tiger-192
- • GOST R 34.11-94, HAVAL, Snefru
Password Hashes:
- • bcrypt ($2$, $2a$, $2b$, $2x$, $2y$)
- • Argon2 (id, d, i variants)
- • scrypt, yescrypt
- • PBKDF2 (structured & raw)
- • HMAC-SHA1/256/512
- • Unix Crypt (DES, MD5, SHA-256/512)
- • Apache MD5 (APR1)
Database Hashes:
- • MySQL 3.x, 4.1/5.x
- • PostgreSQL MD5
- • Oracle 10g, 11g, 12c
- • MSSQL 2000, 2005, 2012+
- • MongoDB ScramSHA1/256
CMS/Frameworks:
- • WordPress ($P$, $H$)
- • Drupal 7+ ($S$)
- • Joomla (bcrypt, MD5+salt)
- • phpBB3 ($H$)
- • vBulletin (3.8.5+, older)
- • Django (PBKDF2, bcrypt)
Windows/Network:
- • LM Hash (deprecated)
- • NTLM, NetNTLMv2, pwdump/NTDS lines
- • Domain Cached Credentials (DCC/DCC2)
- • Cisco Type 5, 7, 8, 9
- • Juniper NetScreen
Tokens / LDAP / Other:
- • JWT (header alg, Hashcat 16500)
- • LDAP SSHA/SSHA256/SSHA512, MD5, SHA
- • Base64 & base64url digests (padded/unpadded)
- • CRC32, CRC64, Adler-32 (checksums)
- • Bitcoin / Ethereum addresses (flagged)
Important Notes
- • Raw Hash Limitation: Cannot distinguish between algorithms with the same output length
- • SHA-3 ≠ Keccak: They share output lengths but use different padding and different Hashcat modes — check the source spec
- • Deprecated Algorithms: MD5 and SHA-1 are cryptographically broken — avoid for new systems
- • PBKDF2 Raw Output: Looks identical to SHA-256, SHA-512, BLAKE variants, etc.
- • Context Matters: Use application context, file extensions, or documentation to confirm identification
- • Addresses aren't hashes: Bitcoin/Ethereum addresses embed a hash but cannot themselves be cracked
- • Authorisation: Never attempt to reverse or crack hashes without explicit permission
Algorithm Categories & Use Cases
Identification Tips
About Hash Identifier & Analyzer
The Hash Identifier & Analyzer inspects hash strings and reports the most likely algorithms behind them, along with format details, structural parameters, and (where applicable) Hashcat mode numbers. It covers 100+ hash types — MD5, SHA-1, the SHA-2 and SHA-3 families, BLAKE2/3, bcrypt, Argon2, scrypt, yescrypt, PBKDF2, Unix crypts, Windows authentication hashes, database password formats, CMS schemes (WordPress, Drupal, Joomla), LDAP variants, and more — and runs entirely in your browser.
Why use a Hash Identifier & Analyzer?
Hash identification is essential for security assessments, forensic investigations, and migrations where you inherit credential data without documentation. This tool removes the guesswork: it ranks candidates by confidence, parses structured formats (bcrypt cost, Argon2 m/t/p, PBKDF2 iterations), and gives you the Hashcat mode number you need to act on the result. Because everything happens client-side, you can paste sensitive hashes without sending them anywhere.
Who is it for?
Built for penetration testers and CTF players who need fast hash identification with Hashcat mode numbers, digital-forensics analysts triaging unknown credential dumps, security engineers auditing third-party authentication code, and platform teams migrating off legacy password schemes. It's also a useful learning aid for developers and students studying password storage and cryptographic hash families.
How to use the tool
Paste one or more hash strings into the input field — one hash per line for batch analysis. Identification runs automatically as you type (the Identify button remains for keyboard/accessibility use)
Read the single-verdict hero card: it names the most likely algorithm with a confidence level and gives ready-to-run `hashcat -m N` and `john --format=<name>` commands you can copy with one tap
Expand 'N other possibilities' to see the full ranked candidate list when a length is shared by several algorithms (e.g. 32-hex could be MD5, NTLM, or LM)
Check the disambiguation hints and characteristics for context — bcrypt cost factor, Argon2 m/t/p, PBKDF2 iterations, and how to tell SHA-2 from SHA-3/Keccak apart
Use the 'Next step' link to open the matching on-site generator/verifier, or the Share button to copy a URL that pre-loads the hash (it is stored in the ?h= parameter, client-side only)
For a credential dump, paste many hashes at once to get a summary table (algorithm → count) and export the whole batch as CSV or JSON
Key Features
100+ hash types detected
Covers cryptographic hashes (MD5/SHA-1/2/3, BLAKE2/3, RIPEMD-160), password KDFs (bcrypt, Argon2, scrypt, yescrypt, PBKDF2), Unix crypts, Windows (LM/NTLM/DCC), database schemes (MySQL, PostgreSQL, Oracle, MSSQL), CMS hashes (WordPress, Drupal, Joomla, phpBB3, vBulletin, Django), LDAP variants, Cisco/Juniper, and Base64-encoded forms.
Confidence-ranked results
Candidates are sorted High → Medium → Low so the most likely algorithm is always at the top, with a clear 'Most Likely' badge. Confidence reflects how unique the format is — structured prefixes like $argon2id$ score High; bare 32-hex strings score Low because many algorithms share that length.
Hashcat modes & John formats
The top candidate ships copy-ready commands for both crackers: Hashcat -m modes (0 MD5, 100 SHA-1, 1000 NTLM, 3200 bcrypt, 34000 Argon2, 16500 JWT) and John the Ripper --format= names (raw-md5, raw-sha256, nt, bcrypt, sha512crypt, argon2, netntlmv2, descrypt, …) so you can move straight from identification to attack/verification without a second lookup.
Structured-format parsing
Parses bcrypt cost factors, Argon2 m/t/p parameters, PBKDF2 iteration counts, and Unix crypt rounds. Flags malformed structures and warns when iteration counts fall below current OWASP recommendations.
Disambiguation hints
When a length matches many algorithms (32, 40, 56, 64, 96, or 128 hex chars), the tool surfaces positive signals to look for — source system, surrounding format, presence of salts — so you can rule candidates in or out.
100% client-side
All analysis runs in your browser. Hashes never leave your device, which matters for forensic evidence, customer credentials, and any hash you wouldn't want logged on a third-party server.
Common Use Cases
CTF & penetration testing
Scenario: You've extracted a credential blob from a target system and need to know which Hashcat mode to use before kicking off a crack.
✓ Identification + Hashcat mode in one step — paste the hash, copy the -m value, run Hashcat.
Digital forensics triage
Scenario: An incident-response engagement hands you an unknown password dump from a compromised application.
✓ Quickly classify the dump by algorithm family without uploading sensitive evidence to an online service.
Legacy migration
Scenario: You're modernising an inherited application and need to identify what password-hashing scheme the previous team used.
✓ Spot deprecated schemes (MD5, SHA-1, MySQL 3.x, LM) and plan a rehash-on-login migration to Argon2id or bcrypt.
Security code review
Scenario: You're reviewing third-party code that stores password hashes and want to confirm what algorithm — and what parameters — it actually uses.
✓ Confirm at a glance whether the stored format is bcrypt with a strong cost factor, Argon2id with sane m/t/p, or something weaker.
Teaching & learning
Scenario: You're explaining password storage to a class or a junior engineer and need concrete examples of each algorithm's output.
✓ Sample buttons load known hashes for MD5, SHA-256, NTLM, bcrypt, and Argon2id — perfect for live demos.
100+ hash types covered by 64+ detection patterns
100% client-side — hashes never leave your device
Static site — no backend dependency
Frequently Asked Questions
How do I identify an unknown hash?
Paste the hash into the box — identification is automatic. The tool reads two signals: structural markers (prefixes like $argon2id$, $2y$, $6$, {SSHA}, or a * / md5 / S: lead) and, for bare hex, the length. It returns a single-verdict 'Most likely' card plus ranked alternatives, because many algorithms share a length (a 32-hex string could be MD5, NTLM, LM, or MD4). For a confident answer, combine the verdict with context from the source system. You can paste many hashes at once (one per line) to classify a whole dump, and share a result via a ?h= URL.
What is a Hashcat mode number, and where do John formats fit in?
Hashcat selects a hash type with a numeric mode via -m (e.g. -m 0 MD5, -m 100 SHA-1, -m 1000 NTLM, -m 3200 bcrypt, -m 34000 Argon2 in Hashcat 6.2.6+). Note 34000 is Argon2 — not 13000 (RAR5) or 13900 (OpenCart), which are unrelated. John the Ripper instead uses named formats via --format= (raw-md5, raw-sha256, nt, bcrypt, sha512crypt, argon2, netntlmv2, descrypt, …). This tool prints both for the top candidate as copy-ready commands, so you can move straight to Hashcat or John without a second lookup.
Does the tool send my hash anywhere?
No. All analysis runs locally in your browser via JavaScript — there is no API call and nothing is logged. You can verify this in your browser's DevTools Network tab: analysing a hash produces zero HTTP requests. The optional shareable link stores the hash in the URL's ?h= parameter, which is handled entirely client-side and only travels if you choose to send that link to someone. This client-side model is why the tool is safe for forensic evidence and real credential dumps where uploading to a third-party service would break chain of custody.
What's the difference between hash identification and hash cracking?
Identification tells you which algorithm produced a hash so you can pick the right tool; cracking attempts to recover the original input, usually by trying billions of candidates (dictionary, brute force, mask attacks). Identification is a sub-millisecond, offline operation; cracking can take seconds to millennia depending on the algorithm and the input's entropy. This tool only identifies — it never cracks. To crack, feed the printed Hashcat -m mode or John --format to those tools, and only against hashes you are explicitly authorised to test (your own systems, CTF challenges, or sanctioned penetration tests).
Is hash identification ever 100% certain?
Only when the hash carries a distinctive structured prefix ($argon2id$, $2y$, $6$, $S$, {SSHA}, *, md5…, S:). For raw hex outputs many algorithms share a length, so certainty is impossible from the string alone: a 64-hex value could be SHA-256, SHA3-256, Keccak-256, BLAKE2s, BLAKE3, or a raw PBKDF2-32 output. That is why the tool returns ranked candidates with confidence levels rather than a single answer, and surfaces disambiguation hints (source system, surrounding fields, salts) to help you rule candidates in or out.
Can this tool identify hashes from a leaked password dump or an NTDS.dit export?
Yes — that is a core use case. Paste hashes one per line and you get a batch summary table (algorithm → count) plus CSV/JSON export of the whole set. It also parses composite lines: a pwdump/NTDS row (user:rid:LM:NT:::) is recognised and the NT hash extracted with mode 1000, and a JWT (three base64url segments) is detected with its header alg and mode 16500. Everything stays in your browser, so you can triage forensic evidence without uploading it — important for chain-of-custody in incident response. Mixed-algorithm dumps (common after a site changed its scheme) are handled line by line.
How do I tell SHA-256 from SHA3-256 and Keccak-256?
You can't from the 64-hex output alone — all three are 256-bit. Use the source: SHA-256 dominates older systems, libraries, and protocols (TLS, Bitcoin, Git); FIPS 202 SHA3-256 appears in newer specs; and Keccak-256 (the pre-standardisation padding) is what Ethereum and the EVM use, often mislabelled 'SHA3' in older docs. They are genuinely different algorithms with different Hashcat modes: SHA3-256 is -m 17400, while Keccak-256 is -m 17800. The tool lists SHA-256 first (by prevalence) and shows SHA3-256 and Keccak-256 as separate, correctly-numbered candidates.
Why are some matches marked 'Low' confidence even though the algorithm name matches?
Low confidence means the format is shared with other algorithms — the algorithm could be present, but length alone isn't enough evidence. A 32-hex string legitimately matches MD5, NTLM, LM, MD4, and raw PBKDF2-16, so all appear at Low. To confirm a password hash, verify it with the suspected algorithm and parameters using the matching on-site tool — for example the bcrypt-hash-generator-verifier, argon2-hash-generator-verifier, or pbkdf2-hash-generator-verifier, each linked from the result's 'Next step'. Structured prefixes, by contrast, score High because the format is unique.
Technical Specifications
Supported Formats
- ✓Cryptographic hashes — MD2/4/5, SHA-1, SHA-2 family, SHA-3 / Keccak, BLAKE2b/2s, BLAKE3, RIPEMD-160, Whirlpool, Tiger-192, GOST, HAVAL, Snefru
- ✓Password KDFs — bcrypt ($2a/$2b/$2x/$2y$), Argon2 (id/i/d), scrypt, scrypt $7$ format, yescrypt, PBKDF2 (structured and raw)
- ✓Unix crypts — DES, MD5 ($1$), SHA-256 ($5$), SHA-512 ($6$), Apache APR1 ($apr1$)
- ✓Database hashes — MySQL 3.x and 4.1/5.x, PostgreSQL MD5, Oracle 10g/11g/12c, MSSQL 2000/2005/2012+, MongoDB SCRAM-SHA-1/256
- ✓CMS / framework — WordPress ($P$/$H$), Drupal ($S$), Joomla, phpBB3, vBulletin, Django (PBKDF2/bcrypt)
- ✓Windows / network — LM, NTLM, NTLMv2, DCC, DCC2, Cisco Type 5/7/9, Cisco IOS SHA-256, Juniper NetScreen
- ✓LDAP / directory — {SSHA}, {SSHA256}, {SSHA512}, {MD5}, {SHA}, {CRYPT}
- ✓Encoded variants — Base64-encoded MD5/SHA-256/SHA-512, HMAC-SHA1/256/512
Limits & Performance
- •File Size: Text input only, no file uploads — analysis is instant for typical hash lengths
- •Validations: 64+ detection patterns covering 100+ algorithms
- •Response Time: Synchronous, in-browser — typically < 5 ms per hash
- •Browsers: All modern browsers (Chrome, Firefox, Safari, Edge); no plugins required
Pro Tips
- Trim whitespace before pasting — leading/trailing spaces will change the length and break length-based detection.
- Paste one hash per line to batch-analyse a credential dump in a single click.
- Look at structural prefixes first ($, {, *, 0x, S:, T:) — they're the most reliable signal and pin down the algorithm immediately.
- Cross-reference with the source application: Django uses pbkdf2_sha256$, WordPress uses $P$, Drupal uses $S$, Linux shadow files use $1/$5/$6/$y$.
- Treat any MD5/SHA-1 match for password storage as 'deprecated — plan a rehash-on-login migration to Argon2id or bcrypt'.
- When several candidates share a length, rely on the disambiguation hints — they list the positive signals (source system, surrounding fields) that distinguish them.
- Copy the Hashcat mode number directly from the result card to avoid mistakes when constructing your -m argument.
Share This Tool
Found this tool helpful? Share it with others who might benefit from it!
💡 Help others discover useful tools! Sharing helps us keep these tools free and accessible to everyone.