Free Online Hash Identifier
An online hash identifier is a cryptographic diagnostic tool that analyzes unknown hash digest strings by length, character set, encoding format, and signature prefixes to identify potential candidate algorithms (such as MD5, SHA-256, NTLM, bcrypt, or Argon2).
Paste an unknown hash string into ScanSuite's hash identifier to instantly analyze its bit length, character set, and structural prefix, returning a ranked list of candidate algorithms with confidence scores and security recommendations.
Identify a hash
Cryptographic hashes are widely used across threat intelligence, incident response, vulnerability management, and database auditing. However, when inspecting raw log files or unknown IOC lists, hash strings rarely state their underlying algorithm explicitly.
ScanSuite's hash identifier analyzes string characteristics — including character length, hexadecimal vs Base64 encoding, and prefix signatures (like `$2a$` for bcrypt or `$argon2id$`) — to classify unknown hashes across 50+ algorithm standards in seconds. Results include security strength ratings so you can prioritize migration away from weak legacy algorithms.
Hashcat and John the Ripper modes
A hash identifier is a pattern-matching tool that compares input string properties against known cryptographic digest specifications. For instance, a 32-character hexadecimal string (`128 bits`) is characteristic of MD5 or NTLM, while a 64-character hex string (`256 bits`) indicates SHA-256 or SHA3-256.
Modern password hashes often include salt parameters and iteration costs within structured prefix tags (e.g. PHC format), which the identifier parses to reveal exact configuration details.
Unlike a hash cracker, an identifier never attempts to recover plaintext — it only classifies the algorithm family so you can choose the correct verification, migration, or audit workflow.
Can a hash be decrypted?
Security analysts evaluating malware IOCs or database dumps frequently encounter unidentified hashes that need classification before querying threat intelligence platforms or configuring scanner filters.
ScanSuite's hash identifier eliminates guesswork by analyzing string length, salt delimiters, and character sets in your browser, providing a ranked list of candidate algorithms alongside security strength ratings for each match.
A hash is a one-way digest. Encryption can be reversed with a key; a hash cannot be decrypted back to the original text. Create a digest with the hash generator at /tools/hash-generator/ and compare it to a value you already have.
Who Uses Hash Identifiers?
SOC analysts and incident responders classify unknown file IOC hashes found during malware investigations.
Penetration testers and security auditors evaluate password hash dumps to determine hashing algorithms and salting practices.
Software developers debug legacy authentication systems to identify which hash algorithms were previously used for password storage.
How hash identification works
The identification engine evaluates four primary attributes: string length (e.g., 32, 40, 64, 128 characters), character encoding set (Hexadecimal, Base64, Base64URL), prefix signatures (`$1$`, `$2b$`, `$6$`, `$argon2id$`), and salt delimiter structures.
Matches are ranked by probability. For example, a 32-character hex string matches MD5, NTLM, Domain Cached Credentials, and MD4 with MD5 and NTLM assigned top confidence levels.
Security ratings flag broken algorithms like MD5 and SHA-1 so auditors can prioritize password hash migration to Argon2id or bcrypt in remediation plans.
Example hashes
Input: `5d41402abc4b2a76b9719d911017c592` → Length: 32 Hex | Candidates: MD5, NTLM, MD4
Input: `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` → Length: 64 Hex | Candidates: SHA-256, SHA3-256
Input: `$2b$12$e8N.g.Yg/3aZ4mY5uK6O0uQ7...` → Prefix `$2b$` | Candidate: bcrypt (Cost: 12)
Hash length reference
| Length or prefix | Example | hashcat -m | John format | |
|---|---|---|---|---|
| MD5 | 32 hex, 5d41402abc4b2a76b9719d911017c592 | 0 | raw-md5 | |
| MD4 | 32 hex | 900 | raw-md4 | |
| NTLM | 32 hex, same length as MD5 | 1000 | NT | |
| SHA-1 | 40 hex, aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d | 100 | raw-sha1 | |
| MySQL 4.1 | * plus 40 hex | 300 | mysql-sha1 | |
| SHA-256 | 64 hex | 1400 | raw-sha256 | |
| SHA-384 | 96 hex | 10800 | raw-sha384 | |
| SHA-512 | 128 hex | 1700 | raw-sha512 | |
| SHA3-256 | 64 hex, same length as SHA-256 | 17400 | raw-sha3-256 | |
| RIPEMD-160 | 40 hex, same length as SHA-1 | 6000 | ripemd-160 | |
| bcrypt | $2y$10$... 60 characters | 3200 | bcrypt | |
| md5crypt | $1$salt$hash | 500 | md5crypt | |
| sha256crypt | $5$salt$hash | 7400 | sha256crypt | |
| sha512crypt | $6$salt$hash | 1800 | sha512crypt | |
| phpass | $P$ or $H$ | 400 | phpass | |
| APR1 | $apr1$salt$hash | 1600 | md5crypt | |
| Argon2id | $argon2id$v=19$m=65536,t=3,p=4$... | — | argon2 | |
| Argon2i | $argon2i$... | — | argon2 | |
| Argon2d | $argon2d$... | — | argon2 | |
| LM | 32 hex, often uppercase, padded | 3000 | LM | |
| NetNTLMv2 | username::domain:challenge:HMAC:blob | 5600 | netntlmv2 | |
| CRC32 | 8 hex, a checksum rather than a password hash | — | — |
Why Are Multiple Algorithms Listed for My Hash?
Algorithms that output identical digest lengths (such as 128-bit digests for MD5, NTLM, and MD4) produce identical hexadecimal string patterns. The tool lists all plausible candidates ranked by common usage.
Related tools
- Hash Generator — Generate MD5, SHA hashes
- SRI Generator — Generate integrity hashes
- Hash Generator — Generate cryptographic hashes for text or files.
- Encoder Decoder — Decode Base64 or Hex encoded strings.
- Password Generator — Generate strong passwords.
- JWT Debugger — Inspect JSON Web Token signatures.
- SRI Generator — Generate Subresource Integrity hashes.
Frequently Asked Questions
What hash is this? How do I identify a hash type?
Paste the hash into the box above. The tool checks its length, character set and any prefix (for example `$2y$` for bcrypt or `$argon2id$` for Argon2) and lists the algorithms it could be, most likely first. A 32-character hex string, for example, is usually MD5 but could also be NTLM or MD4, so treat the results as candidates rather than proof.
How can I tell MD5, SHA-1 and SHA-256 hashes apart?
By length when they are shown as hex: MD5 is 32 characters, SHA-1 is 40, SHA-256 is 64 and SHA-512 is 128. Other algorithms share these lengths (NTLM is also 32, for example), so length narrows it down but does not confirm it. Context helps, such as where the hash came from or which system stored it.
Can a hash be decrypted or reversed?
No. Hashing is one-way, so there is no key to decrypt it. Weak or common passwords can sometimes be recovered by guessing candidates and comparing their hashes (dictionary or brute-force attacks with tools like hashcat), but that is guessing, not decryption. To create hashes for comparison, use the hash generator.
What hashcat mode or John the Ripper format do I need?
Each candidate result shows its hashcat `-m` mode and John the Ripper format name. For example, MD5 is mode 0, SHA-1 is 100, SHA-256 is 1400, NTLM is 1000 and bcrypt is 3200.
Why does the tool show several possible hash types?
Many algorithms produce output of the same length and alphabet, so the hash alone cannot tell them apart. Prefixed formats like bcrypt, Argon2 and `$6$` SHA-512 crypt can be identified with confidence. Plain hex hashes can only be ranked by likelihood.
Is it safe to paste my hash here?
Identification runs in your browser and the hash is not sent to or stored on our servers. Even so, avoid pasting hashes of live production passwords into any website.
What is a hash identifier?
A diagnostic tool that analyzes unknown hash strings by length, character set, and prefix to identify candidate algorithms. It does not recover the original plaintext.
Can a hash identifier reverse or crack my hash?
No. The identifier determines WHICH algorithm created the hash, not WHAT original plaintext was used.
Why do MD5 and NTLM look identical?
Both produce 128-bit digests formatted as 32 hexadecimal characters.
How do I identify a bcrypt password hash?
bcrypt hashes begin with `$2a$`, `$2b$`, or `$2y$` followed by a cost factor (e.g. `$2b$12$`).
How do I identify an Argon2 hash?
Argon2 hashes use structured PHC string format starting with `$argon2i$`, `$argon2d$`, or `$argon2id$`.
Are my hash strings sent to ScanSuite servers?
No. All analysis runs locally in client browser memory for complete privacy.
What is a 64-character hex hash?
Most commonly SHA-256 or SHA3-256 (256-bit digest).
What is a 40-character hex hash?
Most commonly SHA-1 or RIPEMD-160 (160-bit digest).
What is a Linux shadow hash format?
Linux `/etc/shadow` uses prefixes: `$1$` (MD5), `$5$` (SHA-256), and `$6$` (SHA-512).
What is a MySQL password hash format?
MySQL 4.1+ uses `*` followed by 40 uppercase hex characters (SHA-1 double hash).
What is Base64 hash encoding?
Some systems output raw binary digests as Base64 strings (ending in `=` or `==`) rather than hex.
Can this tool detect custom salted hashes?
Yes, if the hash uses a standard delimiter format (like `hash:salt` or `$algorithm$salt$hash`).
What is the most secure password hashing algorithm today?
Argon2id and bcrypt are current industry standards for password storage.
Is this hash identifier tool free to use?
Yes, ScanSuite provides unlimited free hash identification without registration.
How many hash algorithms can this tool identify?
Analyzes over 50 algorithm signatures across cryptographic, password, and checksum families.
Why does my hash show no matches?
If a string contains non-hex characters or non-standard padding, verify that the string was copied completely without truncated characters.
What is John the Ripper / Hashcat format detection?
Matching identified algorithms to exact hashcat mode numbers (e.g. mode 1000 for NTLM, 1800 for sha512crypt).
Can I copy detected algorithm details?
Yes, copy candidate names and security ratings with one click.
What is a hash analyzer or hash detector?
A hash analyzer, hash detector, and hash type identifier all do the same job: they guess which algorithm produced a digest from its length, alphabet, and prefixes. Paste the string above. MD5 and NTLM can look the same, so the page lists candidates rather than a single proof.
How do I identify a hash online without uploading it?
Paste the digest into this hash identifier. The check runs in your browser, so the string is not sent to ScanSuite. Treat the result as a likely type, then confirm it against the system that created the hash.
Summary
Paste a hash to see likely types from its length, character set, and prefixes such as $2y$ or $argon2id$. Candidates include a hashcat mode and a John the Ripper format when one is known. The result is a probability, not a decryption.