Hash Identifier
Identify the likely hash algorithm from a hash string based on length and format.
Common hash lengths (hex):
This hash identifier takes a pasted string and reports every algorithm it could be, based on length, character set, and prefix. It runs entirely in the browser — the hash is never transmitted, which matters if it came out of a production database.
Length narrows the field to a family; the prefix usually settles it. The ambiguities that trip people up are 32 hexadecimal characters, which is MD5 and also NTLM, and 64 hex, which is SHA-256 and several near-relatives. Below: the length table, the prefixes that identify a scheme outright, and how to confirm what the tool can only suggest.
How to identify a hash type
- Paste the hash into the field.
- Read the length: 32 hex means 128 bits, 40 means 160, 56 means 224, 64 means 256, 96 means 384, 128 means 512.
- Check the prefix. $2a$, $2b$, and $2y$ mean bcrypt; $argon2id$ means Argon2; $pbkdf2 means PBKDF2.
- Check the alphabet. Hex only (0-9 and a-f) points to the MD5/SHA family. A $ or . separator points to a crypt-style format.
- Confirm by hashing a known input and comparing. Length alone is a filter, never a proof.
Example
5d41402abc4b2a76b9719d911017c592 is 32 hex characters, so 128 bits — MD5 or NTLM. Hashing the word hello with MD5 produces exactly that string, which confirms it. The same word through SHA-256 gives 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, 64 characters.
How a hash type is identified
Hex characters x 4 = bits. 32 hex = 128 bits (MD5), 40 = 160 (SHA-1), 56 = 224, 64 = 256 (SHA-256), 96 = 384, 128 = 512.
How to use this calculator
- Paste the hash. Leading and trailing whitespace is stripped before matching.
- Read the character count and the match count at the top of the result.
- Work down the list — the matches are ordered from most to least specific.
- Use the length table below the calculator as a cross-check.
- Nothing is sent anywhere: there is no server call and no logging.
Hash length cheat sheet
Bits are simply hex characters times four, because each hex digit carries four bits. That is why 64 characters is 256 bits and not 64.
| Hex chars | Bits | Common algorithms | Status |
|---|---|---|---|
| 8 | 32 | CRC-32 | Checksum only, not a hash for security |
| 32 | 128 | MD5, NTLM | Broken or legacy — do not use |
| 40 | 160 | SHA-1, RIPEMD-160 | Deprecated |
| 56 | 224 | SHA-224, SHA3-224 | Current |
| 64 | 256 | SHA-256, SHA3-256, BLAKE2s-256 | Current |
| 96 | 384 | SHA-384, SHA3-384 | Current |
| 128 | 512 | SHA-512, SHA3-512, BLAKE2b-512 | Current |
Prefixes that identify the scheme outright
A prefix is decisive. No amount of length analysis beats a literal $argon2id$. If a string has no prefix and uses only 0-9 and a-f, it is a raw digest and length is all the information there is.
| Prefix | Scheme | Notes |
|---|---|---|
| $2a$, $2b$, $2y$ | bcrypt | 60 characters total; the two digits after the prefix are the cost factor |
| $argon2i$, $argon2d$, $argon2id$ | Argon2 | Memory, iterations, and parallelism are encoded in the string |
| $pbkdf2-sha256$, $pbkdf2$ | PBKDF2 | Iteration count is stored in the string |
| $1$ | MD5-crypt | Legacy Unix format, not the same as a raw MD5 hex digest |
| $5$ / $6$ | SHA-256-crypt / SHA-512-crypt | Uncommon on modern systems |
| $y$ | yescrypt | Default on some current Linux distributions |
Where the tool has to guess
Three genuine ambiguities. 32 hex: MD5 and NTLM both produce 32 hex characters. They are different algorithms with the same output length, and context decides — an NTLM hash comes from a Windows SAM dump, an MD5 hash comes from almost everything else.
64 hex: SHA-256, SHA3-256, BLAKE2s-256, and SHA-256 HMACs all land here. Length cannot separate them.
44-character Base64: 32 bytes encoded in Base64 is 44 characters ending in a padding equals sign. It looks nothing like hex, but it is the same SHA-256 output in a different encoding.
The tool reports every match on purpose. A confident wrong answer would be worse than an honest list.
How to confirm instead of guessing
- Hash a known input with each candidate and compare. A single command with openssl or shasum settles the SHA family in seconds.
- Check the encoding. Hex is 0-9 and a-f only; Base64 uses + and / and padding.
- Look at the source. A dump from /etc/shadow gives crypt-style strings, a web app password column gives bcrypt or Argon2, a file checksum gives hex.
- Treat length as a filter, never as proof. Two algorithms sharing a length is the normal case, not an edge case.
What this tool does not do
It does not crack, decrypt, or reverse anything. Hashes are one-way functions with no inverse. Recovering an input means guessing candidates and comparing, which is a different tool, a different legality question, and not something this page attempts.
It also cannot tell whether a hash is salted. A salted digest is indistinguishable from an unsalted one by inspection; the salt is often stored alongside or prepended, which changes the length and breaks the length heuristic. A 64-hex string that is really a 32-hex salt plus a 32-hex MD5 will be reported as SHA-256.
Common mistakes
- Treating a matching length as an answer. 32 hex is MD5 or NTLM; 64 hex has several candidates.
- Confusing a raw digest with a crypt-style string. $2y$10$ is bcrypt; a 32-hex string is not.
- Encoding confusion — 44-character Base64 and 32-character hex can be the same MD5 output.
- Assuming a hash is safe because it is long. Length says nothing about the KDF, the salt, or the password's entropy.
FAQ
How do I identify what type of hash I have?
Count the characters and check the prefix. 32 hex is MD5 or NTLM, 40 is SHA-1, 64 is SHA-256, 128 is SHA-512. A leading $2y$ means bcrypt and $argon2id$ means Argon2.
Is a 64-character hash always SHA-256?
Almost always, but SHA3-256, BLAKE2s-256, and SHA-256 HMAC also produce 64 hex characters. Confirm by hashing a known input.
How long is an MD5 hash?
32 hexadecimal characters, which is 128 bits. Base64-encoded it is 24 characters including padding.
How do I identify a bcrypt hash?
It starts with $2a$, $2b$, or $2y$, followed by a two-digit cost factor, a 22-character salt, and a 31-character hash — 60 characters in total.
Can I decrypt a hash?
No. Hashing is one-way. Matching a hash to its input requires guessing inputs, which is cracking, not decryption.
Why does my hash match several algorithms?
Because length is a weak signal. Several algorithms share an output length, and only a prefix or a known-input test can separate them.
What is the difference between a hash and encryption?
Encryption is reversible with a key; hashing is not. A hash is a fixed-length fingerprint used to verify integrity or store a secret.
Is SHA-1 still safe?
Not for signatures or password storage — practical collisions exist. Use SHA-256 or better, and bcrypt, scrypt, or Argon2 for passwords.
Does this tool send my hash anywhere?
No. Everything runs in the browser and the string is never transmitted or logged.