Hash Identifier

Identify hash types by length and character set — detects MD5, SHA, bcrypt, and 20+ more.

Hash to identify

How hash identification works

Hash algorithms produce output of a fixed length and character set. By analyzing the length (in hex digits) and the character set (pure hex vs. mixed case vs. special prefixes like $2y$ for bcrypt), it's often possible to narrow down the algorithm. Many hashes of the same length are indistinguishable from each other — for example, MD5, RIPEMD-128, and NTLM all produce 32 hex characters.

To generate hashes, use the Hash Generator. To check password strength, see Password Strength Checker.

Built and maintained by Meet Shah · Last updated 30 July 2026

What this tool is used for

Narrowing down what a digest found in a database dump or a config file might be, before choosing a tool.
Recognising a bcrypt or PBKDF2 string by its prefix during an audit.
Ruling out algorithms whose output length does not match what you are looking at.
Working out which of several candidates to try first in a CTF challenge.
Confirming that a value which looks like a hash is actually the wrong length for any of them.

Frequently Asked Questions

How can a hash be identified at all?: Only by shape: length, alphabet, and any prefix. A 32-character hex string is 128 bits, a 40 is 160, a 64 is 256. That narrows the field but never settles it — the digest itself is indistinguishable from random data, by design.
Why are several algorithms listed for one hash?: Because they genuinely cannot be told apart. MD5 and RIPEMD-128 are both 128-bit hex; SHA-1 and RIPEMD-160 are both 160; SHA-256, SHA3-256 and SHA-512/256 are all 64 hex characters. Only knowing which system produced it can decide between them.
What makes some formats unambiguous?: A prefix. Modern password hashes carry their own identifier — `$2b$` for bcrypt, `$argon2id$`, `$6$` for SHA-512 crypt, `$1$` for MD5 crypt — followed by cost parameters and the salt. These are Modular Crypt Format strings, and they are self-describing on purpose.
Does identifying a hash help me reverse it?: No. A cryptographic hash is one-way; the only attack is guessing an input and hashing it. What identification buys you is knowing *which* algorithm to guess against — and whether it is a fast one (MD5, SHA-1) or deliberately slow (bcrypt, scrypt, Argon2).
Why does a length not always divide by 8?: Because you may be looking at Base64 rather than hex — 44 characters ending in `=` is a Base64-encoded 256-bit digest, not a 44-bit one. Check the alphabet before the length: hex is 0-9a-f only, Base64 adds the rest of the alphabet plus `+/=`.
Can a hash be identified with certainty from its length?: No. Length narrows the field but does not settle it — a 32-character hex string could be MD5, NTLM, or a truncated anything. Only surrounding context, such as a `$1$` prefix or the system it came from, is conclusive.

Common errors and gotchas

Treating the result as certain. Length and alphabet narrow the field; they cannot single out one algorithm.
Assuming identification helps you reverse it. Knowing the algorithm tells you what to try, not what the input was.
Overlooking prefixed formats, which are self-describing and should be read rather than guessed at.
Forgetting a digest may be encoded rather than hex, which changes the length and defeats a length-based guess.
Ignoring the possibility of double hashing or a salt, neither of which changes the length but both of which change the answer.