Runs in your browser. Your files and text never leave your device - nothing is uploaded.
Identify a Hash Type Online
Found a long string of letters and numbers and need to know what kind of hash it is? The Tools Kit’s free Hash Identifier checks the string’s length and prefix and lists every algorithm that could have produced it: MD5, NTLM, SHA-1, SHA-256, SHA-512, the SHA-3 family, CRC32, bcrypt, Argon2 and the Unix crypt formats.
Results update as you type, and the check runs entirely in your browser, so a hash pulled from your own systems is never uploaded. Where two algorithms share the same output shape, the tool says so rather than pretending to know which one it is.
How to Use the Hash Identifier
- 1
Paste the hash
Paste the full hash string into the Hash String field, including any prefix such as $2b$, $6$ or $argon2id$. Spaces before or after the value are ignored.
- 2
Read the possible algorithms
A table appears as you type, with the most likely algorithm first, plus the Hashcat mode and John the Ripper format for each. Several rows mean those algorithms produce output of exactly the same shape.
- 3
Check the character count if nothing matches
If no rule fits, the tool shows how many characters you entered. Remove stray characters such as a 0x prefix, inner spaces or colons, then compare the length against the table on this page.
- 4
Narrow it down with context
Use where the hash came from, such as a Windows password store, a download page or a web app database, to choose between the remaining candidates.
Hash Length Chart: What Hash Is This?
A hash function always returns the same number of bits, whatever the size of the input. Shown as hexadecimal, each byte becomes two characters, so bits = hex characters × 4. A 64-character string is therefore a 256-bit digest. These are the lengths the tool recognizes:
| Hex characters | Bits | Possible algorithms |
|---|---|---|
| 8 | 32 | CRC32 |
| 32 | 128 | MD5, NTLM, MD4 |
| 40 | 160 | SHA-1, RIPEMD-160 |
| 56 | 224 | SHA-224, SHA3-224 |
| 64 | 256 | SHA-256, SHA3-256 |
| 96 | 384 | SHA-384, SHA3-384 |
| 128 | 512 | SHA-512, SHA3-512, Whirlpool |
As a worked example, the word “hello” hashes to 5d41402abc4b2a76b9719d911017c592 with MD5 (32 characters) and to aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d with SHA-1 (40 characters). You can reproduce these yourself with the MD5 hash generator and confirm a 64-character result with the SHA-256 hash generator.
Why Some Hashes Cannot Be Told Apart
Length narrows the field, but it rarely settles it. SHA-256 and SHA3-256 are completely different designs that both output 256 bits, and the SHA-256 of “hello” looks just as random as its SHA3-256 (3338be69...). MD5, MD4 and NTLM share 32 characters for the same reason. That is why the tool shows several candidates: an honest shortlist is more useful than a confident wrong answer.
The deciding clue is usually context. A 32-character value from a Windows credential dump is almost certainly NTLM. A 64-character value next to a download link is almost always SHA-256. A signature in a webhook header is often an HMAC rather than a plain hash; the HMAC generator lets you test that by recomputing it with the shared secret. Values that end in = or contain + and / are usually Base64 rather than hex, and are worth running through the Base64 decoder first. And if the string has two dots and starts with eyJ, it is a token, not a hash: open it in the JWT decoder.
Recognizing Password Hash Formats
Modern password hashes are easier to identify because they label themselves. The modular crypt format starts the string with an identifier between dollar signs, followed by settings and the salt, so the algorithm is written into the hash itself. The tool recognizes these prefixes:
| Prefix | Algorithm | Looks like |
|---|---|---|
$2a$, $2b$, $2y$ + two-digit cost | bcrypt | $2b$12$... |
$1$ | MD5 Crypt (Unix) | $1$salt$... |
$5$ | SHA-256 Crypt (Unix) | $5$salt$... |
$6$ | SHA-512 Crypt (Unix) | $6$salt$... |
$apr1$ | Apache MD5 (apr1) | $apr1$salt$... |
$P$, $H$ | phpass (WordPress, phpBB) | $P$B... |
pbkdf2_sha256$ | Django PBKDF2-SHA256 | pbkdf2_sha256$600000$... |
$argon2i$, $argon2d$, $argon2id$ | Argon2 | $argon2id$v=19$... |
Only the prefix is checked for these formats, not the full length, so the result tells you the scheme rather than confirming the hash is complete. To see a real bcrypt string, including its cost factor and salt, create one with the bcrypt generator. Finding a bare MD5 or SHA-1 digest in a password column is itself a warning sign, because fast general-purpose hashes can be guessed billions of times per second. The password strength checker estimates a password’s entropy, which shows why short passwords stored that way do not last long.
Common uses
- Working out what an unlabeled hash column in an inherited database contains
- Checking which checksum a download page published before you verify a file
- Spotting legacy password storage that still uses MD5 or SHA-1 during a security review
- Recognizing bcrypt, Argon2 and Unix crypt strings in config files and /etc/shadow entries
- Picking the right mode in a password-recovery or CTF tool before you start
For more hashing, encoding and inspection utilities, browse all security tools on The Tools Kit.
Hash terms explained
| Term | What it means here |
|---|---|
| Digest | The fixed-size output of a hash function; the same input always produces the same digest |
| Hexadecimal (hex) | Base-16 text using 0-9 and a-f; each byte of a digest becomes two hex characters |
| Modular crypt format | A self-describing password hash string such as $6$salt$hash, where the leading $id$ names the algorithm |
| Salt | Random data mixed into a password before hashing so identical passwords produce different hashes |
| Cost factor | The work setting in a slow hash; in bcrypt it is the two digits after the prefix, such as 10 or 12 |
| Checksum | A short value such as CRC32 used to detect accidental corruption; it offers no protection against tampering |
Frequently Asked Questions
Paste it into the Hash Identifier. Plain hex digests are matched by length: 8 characters for CRC32, 32 for MD5, NTLM or MD4, 40 for SHA-1 or RIPEMD-160, 56 for SHA-224 or SHA3-224, 64 for SHA-256 or SHA3-256, 96 for SHA-384 or SHA3-384 and 128 for SHA-512, SHA3-512 or Whirlpool. Password hashes are matched by prefix, such as $2b$ for bcrypt, $6$ for SHA-512 Crypt, $P$ for phpass and $argon2id$ for Argon2.
Count the characters. An MD5 digest is 128 bits, shown as 32 hex characters, while SHA-256 is 256 bits, shown as 64 hex characters. For example, the MD5 of "hello" is 5d41402abc4b2a76b9719d911017c592 and its SHA-256 is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.
Different algorithms can produce output of the same length, and hex digests carry no label. MD5, MD4 and NTLM all give 32 hex characters, and SHA-256 and SHA3-256 both give 64. Nothing in the string separates them, so the tool lists every candidate, marking the most common one as most likely rather than claiming certainty.
The results table shows both for each candidate: for example, MD5 is Hashcat -m 0 and John --format=raw-md5, NTLM is -m 1000 and --format=nt, SHA-256 is -m 1400 and --format=raw-sha256, and bcrypt is -m 3200 and --format=bcrypt. A dash means there is no single well-established mode. Only test hashes you own or are authorized to assess.
No. Both are 32 hex characters with no prefix. The source decides it: NTLM hashes come from Windows password stores such as SAM dumps or domain controllers, while MD5 is more common in file checksums, older web apps and cache keys.
A bcrypt hash starts with $2a$, $2b$ or $2y$, followed by a two-digit cost factor and another dollar sign, for example $2b$12$. The full string is normally 60 characters. The tool checks the prefix and cost digits, not the total length, so a truncated bcrypt value will still be labeled bcrypt.
They are Unix crypt identifiers found in files such as /etc/shadow. $1$ is MD5 Crypt, $5$ is SHA-256 Crypt and $6$ is SHA-512 Crypt. The salt sits between the next pair of dollar signs, and the hash follows it.
No. Hash functions are one-way, so there is nothing to decrypt. The tool only tells you which algorithms fit the format. Recovering an input means guessing candidates and hashing each one until the output matches, which this tool does not do.
The value must be pure hex of a supported length, or start with a supported prefix. A 0x prefix, spaces or colons inside the value, a Base64-encoded digest, or a format the tool does not cover (such as LM or BLAKE2 hashes) will not match. In that case the tool shows the character count so you can investigate further.
No. Hex matching is case-insensitive, so 5D41402ABC4B2A76B9719D911017C592 and 5d41402abc4b2a76b9719d911017c592 are both identified as a 32-character digest.
No. Identification runs entirely in your browser with simple pattern rules, so the value you paste is never uploaded, stored or logged.
Reviewed by Raja Jahangir · Last reviewed: October 7, 2026
How do you identify what type of hash a string is?
To identify a hash, paste it and the likely algorithm is guessed from its length and prefix. A 32-character hex string could be MD5, MD4, or NTLM; 40 characters suggests SHA-1; 64 suggests SHA-256 or SHA3-256; 128 suggests SHA-512. Prefixes like $2b$, $6$, and $argon2id$ pinpoint bcrypt, SHA-512 Crypt, and Argon2. Matching runs in the browser.
Can you tell MD5 from NTLM by looking at the hash?
No. MD5, MD4, and NTLM all produce 32 hexadecimal characters, so format alone cannot separate them, and the same applies to SHA-256 versus SHA3-256 at 64 characters. Telling them apart needs context about where the hash came from: NTLM hashes come from Windows password stores, while MD5 is common for file checksums.