Security

Hash Identifier

Paste a hash and I show the likely algorithms from its length and character set (32 hex → MD5/NTLM, 40 → SHA-1, 64 → SHA-256, $2b$ → bcrypt…). Handy to recognize what you are looking at.

redzilla.cl — hashid

Length

—

characters

Format

—

character set

Candidates

—

likely algorithms

Likely algorithms

#	Algorithm	Reason

How I identify it · length, format and prefixes

1. A hash carries no label saying which algorithm produced it, but its length and character set narrow the options a lot. 32 hex characters are almost always MD5, NTLM or MD4.

2. By hex length: 8 → CRC32/Adler-32, 16 → MySQL(old)/CRC64, 32 → MD5/NTLM/MD4/LM, 40 → SHA-1/RIPEMD-160/MySQL5, 56 → SHA-224, 64 → SHA-256/SHA3-256/BLAKE2s, 96 → SHA-384, 128 → SHA-512/SHA3-512/BLAKE2b.

3. Modern crypt hashes are recognized by their prefix with full certainty: $2a$/$2b$/$2y$ → bcrypt, $1$ → md5crypt, $5$ → sha256crypt, $6$ → sha512crypt, $argon2…$ → Argon2, {SSHA} → SSHA (LDAP)…

4. It is a hint, not a verdict: MD5, NTLM and MD4 share the same length, so the list is of candidates. The context (where the hash came from) decides which one it is.

Classified locally in your browser · no sign-up · nothing leaves your browser

How it works

The identifier classifies a pasted hash (it computes nothing) using two clues: the length and the character set. For hexadecimal strings it applies the classic table: 8 characters → CRC32/Adler-32, 32 → MD5/NTLM/MD4, 40 → SHA-1/RIPEMD-160, 56 → SHA-224, 64 → SHA-256/SHA3-256/BLAKE2s, 96 → SHA-384 and 128 → SHA-512/SHA3-512/BLAKE2b. If the string is base64, it estimates the digest bytes and suggests the algorithms that produce that size.

Modern crypt formats are recognized with certainty by their prefix: $2a$/$2b$/$2y$ is bcrypt (including the cost factor), $argon2id$ is Argon2, $1$ md5crypt, $5$ sha256crypt, $6$ sha512crypt, $y$ yescrypt, $P$/$H$ phpass and {SSHA} the LDAP salted SHA-1, among others. For everything else the output is a list of candidates ranked by likelihood, because several algorithms share the same length: the context where the hash came from decides which one it is.

Example: which algorithm produced 5d41402abc4b2a76b9719d911017c592?

The string has 32 characters and uses only hexadecimal digits.
The length table proposes the candidates: MD5 (the most common), NTLM, MD4, LM and others that share the 128-bit size.
By contrast, if you paste $2b$12$R9h/… the prefix identifies it with certainty as bcrypt with cost 12: no ambiguity is possible.

Frequently asked questions

How can I tell whether a hash is MD5 or NTLM when both are 32 characters?

From the format alone, you cannot: both are 128 bits in hexadecimal. Context makes the difference: a hash pulled from Active Directory or a Windows SAM file is almost always NTLM; one shipped next to a download or found in an old web database is usually MD5. That is why the tool returns candidates, not a verdict.

What does the $2b$12$ prefix in a hash mean?

It is bcrypt in modular format: $2b$ marks the algorithm variant and 12 is the cost factor, meaning 2^12 = 4096 internal iterations. The higher the cost, the slower it is to compute and to brute-force. The $2a$ and $2y$ variants are historical revisions of the same scheme.

What if the string is neither hexadecimal nor has a known prefix?

If it is valid base64, the tool computes the decoded bytes and suggests digests that produce that size (16 bytes → MD5, 32 → SHA-256, and so on). If it is base64url, it notes it could be a JWT segment or a token rather than a raw hash. If nothing fits, it says so: not every random string is a hash.

Is it safe to paste real password hashes here?

The classification runs entirely in your browser: nothing is sent to any server and the hash is not stored. Even so, treat password hashes as sensitive information: anyone who obtains them can try to crack them offline.

Was this tool useful?

Disclaimer

We take great care to keep every tool accurate and review it thoroughly; even so, we can't guarantee it is free of errors or take responsibility for how the results are used. We recommend double-checking anything critical.

Found an error? Let us know →