Hash Identifier

A hash identifier examines an unknown hash and guesses its algorithm from telltale format cues: length, character set, and structural prefixes. A 32-hex-character string is likely MD5; 40 chars SHA-1; 64 chars SHA-256; a string starting $2b$ is bcrypt; $argon2 is Argon2. It reads the fingerprint of the fingerprint.

The need arises whenever a hash turns up without a label — in a database column, a config file, a leaked dataset, a CTF challenge, or legacy code — and the next step (verifying, cracking in authorized testing, or migrating) depends on knowing what produced it.

Paste a hash and get its likely type(s), ranked by how well the format matches — all analyzed in your browser.

Where it helps: security auditing and pentesting (authorized) — identifying stored hash formats before assessing their strength or attempting recovery; database migration and code archaeology — inheriting a system and needing to know how it hashed passwords (an MD5 password column is a finding: it needs upgrading to bcrypt on next login); CTF and forensics — the standard first step on a captured hash; and debugging — confirming a value is the hash type you expected.

Honest limits: identification is inference from format, not certainty — many algorithms share output lengths (a 64-hex string could be SHA-256, SHA3-256, or others; a 32-hex string could be MD5 or NTLM), so the tool offers candidates, not a verdict. Salted and prefixed formats (bcrypt's $2b$, Argon2's $argon2id$) identify cleanly; bare hex hashes are ambiguous by length alone. The identification is passive analysis — no cracking, no lookup — and everything stays in your browser.