Use the free Hash Type Identifier below: your data never leaves your browser — all work happens on your device, and nothing is uploaded to any server.
Reading a hash like a detective reads a footprint
You find a hash in a database dump, a log file or a forum post: a string of hex characters, maybe 32 long, maybe 64. What algorithm made it? The hash itself does not say. Hash functions are designed to be one-way, and they deliberately carry no label. But the shape of the string gives clues. Its length narrows the field a lot, its character set narrows it further, and special prefixes narrow it to a single answer. This tool reads those clues and lists the algorithms that could have produced your hash.
Length is the strongest clue for plain hex hashes. Thirty-two hex characters means 128 bits, which points to MD5, the most common 128-bit hash, though NTLM and MD4 share the size. Forty characters means 160 bits, which is SHA-1. Sixty-four means 256 bits, usually SHA-256, though SHA3-256 and BLAKE2s share the size. Ninety-six is SHA-384, and 128 is SHA-512, shared with SHA3-512 and Whirlpool. The tool reports all the matches, because length alone can never prove which one it is.
Password hashes are easier, because they label themselves
Modern password hashes are not bare hex. They carry a prefix that names the algorithm, a cost parameter and a salt, all in one string. A hash starting with $2b$ is bcrypt. One starting with $argon2id$ is Argon2, the current recommended password hash. $1$ is MD5 crypt, $6$ is SHA-512 crypt, and $5$ is SHA-256 crypt. These prefixes exist so that the system verifying a password knows which algorithm and parameters to use. They also make identification trivial: if you see the prefix, you know the algorithm.
That is also why the tool treats a hash with a known prefix as a near-certain match, while a bare hex string only gets candidates. A prefix is a label the designer put there on purpose. A bare hex string is just a number, and many algorithms produce numbers of the same size.
Why identification can never be certain
There are three reasons a hash cannot be identified with certainty from its shape alone. First, collisions of size: several algorithms share output lengths, as shown above. Second, encoding: a hash stored in base64 looks completely different from the same hash stored in hex, and a truncated hash looks like a shorter algorithm’s output. Third, salting and stretching: password systems often store a hash together with a salt, or iterate the hash thousands of times, and the stored string may include the salt, the parameters, or both.
There is also a deeper limit. Given only a hash, you cannot even tell what was hashed. The same 32 hex characters could be the MD5 of a password, of a file, or of nothing at all. Identification tools answer the question “what could this be”, not “what is this”. Any tool that claims certainty from a bare hash is overselling. Treat the result as a shortlist for further investigation, not as a verdict.
How to use the shortlist
Start with the context where you found the hash. A hash from a Linux shadow file with a $6$ prefix is SHA-512 crypt, and that settles it. A 32-character hex string from a web application database is most likely MD5, because that is what older applications used. A 64-character hex string from a modern system is most likely SHA-256. Then test your hypothesis: hash a known value with the candidate algorithm and compare formats. If you are doing security research, remember the legal and ethical boundaries: identifying a hash format is fine, but attempting to crack someone else’s passwords is not, unless you have explicit permission.
One more practical note: if you are building a system today, do not store bare MD5 or SHA-256 of passwords. Use Argon2 or bcrypt, which are slow by design and include a salt. Fast hashes like MD5 can be brute-forced at billions of guesses per second on modern hardware. The existence of this identification tool is itself a reminder of how much legacy hashing is still out there.
Common questions
Can this tool crack my hash? No. It only identifies the format; it never tries to reverse the hash. Why does my hash show several candidates? Because several algorithms share the same output length and character set. Can a hash be identified from its value alone? No, only narrowed down. Context and prefixes do the rest. Is my hash uploaded? No. Identification runs entirely in your browser.