Hash Identifier

What this tool does

Hash Identifier inspects the structure of a pasted hash, such as its prefix, character alphabet and length, and lists the password-hash and digest formats it could be, from bcrypt and sha512crypt to raw MD5, SHA-256 or Ethereum’s Keccak-256. It handles many hashes at once, shows the matching hashcat mode for each candidate, and can recompute common raw and keyed algorithms locally to confirm a guess when you already know the plaintext.

Hashes rarely come labelled. A password export, a leaked credential list or an old database dump hands you a string of characters with no indication of whether it is MD5, SHA-1, a salted combination, or a structured format like Django’s pbkdf2_sha256$ or a Unix $6$ shadow entry. Recognising the shape of that string, rather than guessing, is the fastest way to know which tool or hashcat mode to reach for next.

This identifier checks a pasted value against dozens of recognisable patterns: prefixed formats such as bcrypt, md5crypt, Argon2’s PHC string, phpass, Drupal and several LDAP password schemes, framework-specific strings from Django, Flask and passlib, and plain hexadecimal or Base64 digests classified by their bit length. Paste as many lines as you like and each gets its own ranked list of candidates with a hashcat mode number where one exists. If you already know the original plaintext, entering it lets the tool recompute raw hashes, NTLM and the double-SHA1 MySQL format and mark an exact match, turning a guess into a confirmed answer.

How to use Hash Identifier

1. Paste one or more hashes into the input box, one per line, or load the built-in sample set.
2. Read the detected format label under each hash, such as “Hex, 256 bits” or “Modular crypt”.
3. Check the table of candidate algorithms, ordered with the most likely format first.
4. Note the hashcat mode number next to a candidate if you plan to attempt recovery with hashcat.
5. If you know the plaintext that produced a hash, type it into “Known plaintext” to let the tool confirm a match automatically.
6. Copy the full report, which lists every hash alongside its candidates, for your notes or a ticket.

Tips for better results

• A 32-character hex string is almost always MD5, but it could also be NTLM or half of a longer hash truncated by a buggy export; check the source system if unsure.
• Formats with dollar-sign sections, like $6$ or $2b$, are far easier to identify correctly than plain hex because the prefix itself names the algorithm and parameters.
• A colon inside the value, as in hash:salt, usually marks an unsalted hash algorithm concatenated with its own salt rather than a single exotic format.
• If the identifier returns “Unknown”, check for stray whitespace, a line-wrapped value, or an unsupported encoding such as uuencoding before assuming the format is obscure.

Common use cases

• Working out which hashcat mode to target when attempting authorised password recovery or an audit.
• Classifying unlabelled hashes found during incident response or while reviewing an old database export.
• Confirming that a password migration script produced the expected hash format, such as pbkdf2_sha256$ for Django.
• Learning to recognise common password-storage formats by pasting known examples and reading the breakdown.

Common mistakes to avoid

• Treating the top candidate as certain. Many formats share the same length and alphabet, so the list is a ranked guess, not a proof, until confirmed with a known plaintext.
• Ignoring the prefix on a structured hash and matching only by length, which can mistake a Django PBKDF2 string for a random Base64 blob.
• Assuming every 64-character hex string is SHA-256; SHA3-256, Keccak-256 and BLAKE2s-256 all produce the same length and need extra context to tell apart.