How to Identify an Unknown Hash Type
Enyong Carinton Tegum·
August 8, 2025·
1 min read
You've inherited a database or found a hash in a config and need to know what algorithm produced it. The hash's length and format are strong clues.
Identify by length
- 32 hex characters → likely MD5
- 40 hex characters → likely SHA-1
- 64 hex characters → likely SHA-256
- Starts with
$2y$/$2a$→ bcrypt - Starts with
$argon2→ Argon2
Why it matters
Knowing the type tells you how secure stored passwords are. If you find MD5 or SHA-1 protecting passwords, that's a red flag — they're too fast and broken for that purpose (see our hashing guide). bcrypt/Argon2 are the safe ones.
Identify instantly
Our free hash identifier analyses a hash and suggests its type. Generate hashes with the MD5, SHA-256 and bcrypt tools.
Bottom line
Length and prefix usually reveal a hash's type — 32/40/64 hex for MD5/SHA-1/SHA-256, $2y$ for bcrypt. If passwords are stored as MD5 or SHA-1, plan to upgrade to bcrypt or Argon2. A hash identifier confirms the type in a click.
