Hash Identifier

You find a string of hexadecimal digits in a database dump, a configuration file or a download page, and wonder what it is. Is it a checksum of a file, a stored password, a token? The answer starts with the algorithm, and often the string itself gives strong hints: its length in digits, the characters it uses, and a prefix such as $2y$. This identifier reads those hints and lists the candidates, with a note on how likely each one is.

How identification works

Every hash function produces a fixed number of bits, and written in hexadecimal that is a fixed number of digits: 32 for 128 bits, 40 for 160, 64 for 256, 128 for 512. So length alone cuts the field. Alphabet matters too: a Base64 string ending in = is not hexadecimal. And formats that store the algorithm, salt and cost in the string, such as bcrypt and Argon2, announce themselves with a prefix and can be recognised with certainty.

A worked example

Press Sample. The first value, 5f4dcc3b5aa765d61d8327deb882cf99, has 32 hex digits. The page lists MD5 as likely (a plain 128-bit digest, broken for security but fine for spotting accidental damage), then NTLM, MD4, the old LM hash and rarer 128-bit digests as possible, each with a hashcat mode: -m 0 for MD5, -m 1000 for NTLM, -m 900 for MD4 and -m 3000 for LM. It also notes that the value is lower case, which makes LM less likely. The second, da39a3ee5e6b4b0d3255bfef95601890afd80709, has 40 digits: SHA-1 is likely (-m 100), with RIPEMD-160 (-m 6000) and the MySQL 4.1 password hash (-m 300) as other possibilities. The third, e3b0c442…b855, has 64 digits and gives SHA-256 as likely (-m 1400) and SHA3-256 (-m 17400) and others as possible. Bcrypt and Argon2id strings are listed as certain.

Confidence levels

Certain means the format identifies itself, so there is no other reading. Likely means the most common algorithm of that length, such as MD5 for 32 digits or SHA-256 for 64. Possible means other algorithms share the shape, and context decides: where the value was found, which software wrote it, and what else is stored with it. A column of 32-digit values named ntlm in a Windows dump is NTLM, not MD5.

Plain digests and password hashes

The page also tells you whether a format is normally a plain digest of data, used for checksums, or a password hash, designed to be slow or salted. A plain unsalted MD5 or SHA-1 in a user table is a security finding by itself, because such hashes fall to dictionary attacks in seconds. A bcrypt, scrypt or Argon2 value in the same place is what you hope to see.

Using it responsibly

The hashcat and John columns exist for authorised work: testing your own organisation’s password storage, recovering a password you lost, or teaching. Do not use them against accounts or systems you have no permission to test.

Limits

Identification is probabilistic for plain digests. Salted or custom schemes, such as an application that hashes twice or adds a secret pepper, may not be recognised or may look like something else. The page cannot tell what a hash was made from, only what kind it is. Nothing is uploaded.

Related tools

• Hash Generator computes the plain hashes so you can compare.
• Bcrypt Hash Generator creates and verifies bcrypt strings.
• File Checksum Verifier uses the length rule to compare downloads.
• IOC Extractor pulls hashes out of reports for identification.