Hash Identifier
Paste a hash — or a full shadow-file line — to see the most likely algorithms, ranked by confidence, with the matching hashcat mode and John the Ripper format. Detection uses structural markers ($2b$, $6$, {SSHA}…) and digest length; analysis happens entirely in your browser and nothing is sent anywhere.
About this tool
Paste a hash, or a whole colon-separated shadow-file line, and the tool ranks the algorithms it could be. It checks structural markers first — a $2b$ prefix is bcrypt, $6$ is sha512crypt, {SSHA} is salted LDAP SHA-1 — and falls back to digest length when there is no marker, so a bare 32-hex string comes back as MD5, NTLM and a few others. Each candidate carries a confidence level and, where one exists, the hashcat mode and John the Ripper format string. Detection is heuristic and runs entirely in your browser; a match narrows the search, it does not confirm the algorithm or imply the hash is crackable.
When to use it
Questions
Does knowing the hash type let me reverse it?
No. A cryptographic hash is one-way by design — identifying it as SHA-256 or bcrypt tells you nothing about the input. The type only tells an attack tool which algorithm to compute while it guesses candidate passwords; recovery still depends on the password being weak or already in a wordlist. A strong password behind a slow hash like bcrypt or Argon2 stays out of reach regardless of what this tool says.
Why do MD5 and NTLM show up for the same input?
Both produce a 128-bit digest, which is 32 hexadecimal characters, and neither carries a prefix or any other structural marker. When there is nothing but length to go on, every algorithm of that length is a candidate — 32 hex could also be MD4, LM, or RIPEMD-128. The tool lists them in rough order of how often they occur in practice, but it cannot tell them apart from the string alone. Context decides: an NT hash comes out of a Windows SAM or a secretsdump, a raw MD5 from an application database.
What do the hashcat mode numbers mean?
hashcat identifies each hash format by a number passed with -m: 0 is raw MD5, 100 is SHA-1, 1400 is SHA-256, 1000 is NTLM, 3200 is bcrypt, 1800 is sha512crypt. The number selects both the algorithm and how the salt and any iteration count are parsed out of the input line, so the mode has to match the exact format, not just the underlying hash function. The tool prints the mode next to each candidate so you can drop it straight into a hashcat command.
How does it identify the $-prefixed hashes?
Those are Modular Crypt Format strings, where a $-delimited tag at the front names the scheme: $1$ is md5crypt, $5$ sha256crypt, $6$ sha512crypt, $2a$/$2b$/$2y$ bcrypt, $argon2id$ Argon2. The fields after the tag hold the cost or iteration parameters and the salt, then the digest. Because the tag is unambiguous, these match at high confidence — unlike the bare-hex case, there is only one answer. LDAP hashes work the same way with a {SSHA} or {SHA} prefix instead.
Can it tell whether a hash is salted?
Only when the salt is stored in the hash. Formats like bcrypt, sha512crypt and {SSHA} embed the salt in the string, so their presence tells you the hash is salted and the tool can say so. A bare digest — 32 or 64 hex characters — gives nothing away: it might be an unsalted MD5, or a salted one where the salt lives in a separate database column the tool never sees. If you control the schema, check for a salt column before assuming the hash stands alone.
What does it mean when nothing matches?
Usually one of three things: the string is not a hash (plain text, a token, a base64 blob of something else), it is a hash of a length or format the tool has no rule for, or it is an encrypted value rather than a digest. Check the length — is it a clean multiple of 4 or 8 hex characters? — and look for a prefix or delimiter that identifies a scheme. A hash embedded in a larger structure (a PHC string variant, a vendor-specific format) may need the surrounding fields stripped before it resembles anything standard.
Is it safe to paste a hash here?
The analysis runs in your browser and nothing is transmitted or logged. A password hash is still sensitive material — it is the thing an attacker wants — so treat it with the same care as the credential it protects, and prefer a local tool like this one over a site that could record what you submit. If a hash may have been exposed, the right response is to force a password reset, not to rely on the algorithm being slow.
Why does one input return several candidates?
Because more than one algorithm is consistent with what the tool can observe. Length-based detection is inherently ambiguous: many hash functions share an output size and leave no other trace in the string. The list is ranked, so the first entry is the most likely in typical data, but the tool deliberately shows the alternatives rather than guessing — the deciding evidence is almost always where the hash came from, which only you know.