Hash Identifier

Paste any hash string and get a shortlist of likely algorithms — MD5, SHA-1, SHA-256, SHA-512, bcrypt, and more — based on its character length, character set, and any recognizable prefix.

Quick Facts

Method
Length + character-set + prefix signature matching
The same length-based approach used by tools like hashid and Name-That-Hash.
Common digest lengths
32 hex = MD5/NTLM, 40 hex = SHA-1, 64 hex = SHA-256
Identical length never proves the algorithm — treat matches as a shortlist to verify.

Your Results

Calculated
Character length
-
Length of the trimmed hash string
Detected character set
-
Alphabet used by the string
Most likely algorithm
-
Best match for this length, charset & prefix
Other possible matches
-
Alternates sharing this signature

Ready

Paste a hash value and press Identify.

About the Hash Identifier

This tool identifies the most likely algorithm behind an unknown hash string by matching three signals: the exact character length, the character set (alphabet) used, and any self-describing prefix. It follows the same convention used by well-known command-line hash identification utilities such as hashid and Name-That-Hash.

The method: length, charset, and prefix

Every hash algorithm produces a fixed-size digest, no matter how long or short the original input was. MD5 always outputs 128 bits, SHA-1 always outputs 160 bits, and SHA-256 always outputs 256 bits. When a digest is written out as hexadecimal, each byte becomes exactly two characters, so:

  • 32 hex characters (128 bits): MD5, MD4, NTLM, LM hash, or RIPEMD-128
  • 40 hex characters (160 bits): SHA-1, RIPEMD-160, or HAS-160
  • 56 hex characters (224 bits): SHA-224 or SHA3-224
  • 64 hex characters (256 bits): SHA-256, SHA3-256, BLAKE2s, or GOST R 34.11-94
  • 96 hex characters (384 bits): SHA-384 or SHA3-384
  • 128 hex characters (512 bits): SHA-512, SHA3-512, Whirlpool, or BLAKE2b
  • 8 hex characters (32 bits): CRC32 or Adler-32

If the same digest is written in Base64 instead of hex (packing 3 bytes into every 4 characters, with '=' padding), the same algorithms produce different, shorter lengths: MD5 becomes 24 characters, SHA-1 becomes 28, SHA-256 becomes 44, SHA-384 becomes 64, and SHA-512 becomes 88. These are the exact lengths used by Subresource Integrity (SRI) hashes on the web (sha256-..., sha384-..., sha512-...).

Some formats skip the guesswork entirely because they embed a self-identifying prefix. bcrypt hashes start with $2a$, $2b$, or $2y$ followed by a two-digit cost factor. Unix crypt(3) hashes use $1$ for MD5-crypt, $5$ for SHA-256-crypt, and $6$ for SHA-512-crypt. Argon2 hashes start with $argon2i$, $argon2d$, or $argon2id$. When a prefix matches, the identification is direct rather than a length-based guess.

Why identification is a shortlist, not a certainty

A hash is a one-way function — you cannot reverse it to recover the algorithm with certainty from the output alone. Multiple algorithms frequently share the exact same digest size: MD5 and NTLM are both 32 hex characters, and SHA-1, RIPEMD-160, and HAS-160 are all 40 hex characters. Without a distinguishing prefix or outside context (where the hash came from, what software produced it), length and character set alone can only narrow the field to a shortlist of candidates, ranked by how common each algorithm is in practice.

How to get the best results

  • Paste the hash exactly as you found it, including any $-delimited prefix — do not trim what looks like punctuation.
  • If you know where the hash came from (a Linux password file, a Windows domain, a file checksum, a web integrity tag), select it in the optional context field to reorder the shortlist toward the most probable match.
  • Treat the "most likely" result as a starting point. Confirm it by hashing a known plaintext with the candidate algorithm and comparing the output, whenever that is possible.

Practical context

This tool performs pattern matching only — it does not crack, decrypt, brute-force, or reverse a hash, and it never sends your input anywhere; everything runs in your browser. Use it to narrow down what you are looking at (for example, before choosing which tool or wordlist to try next), not as proof of an algorithm's identity.

Frequently Asked Questions

How does hash identification by length actually work?
Every hash algorithm produces a fixed-size digest. MD5 always outputs 128 bits (32 hex characters), SHA-1 always outputs 160 bits (40 hex characters), and SHA-256 always outputs 256 bits (64 hex characters). By measuring the length and character set of an unknown hash and comparing it to the known output sizes of common algorithms, you can narrow the possibilities to a short list of candidates.
Can this tool tell me the exact algorithm with certainty?
Not with certainty in most cases. A hash is one-way, so its length and character set only narrow down the possibilities; several algorithms can share the same output size (for example MD5 and NTLM are both 32 hex characters). The only exceptions are formats with a self-describing prefix, such as bcrypt ($2b$) or Unix SHA-512 crypt ($6$), which identify themselves directly.
What is the difference between hex-encoded and Base64-encoded hashes?
Hex encoding represents each byte as two characters from 0-9 and a-f, so a 16-byte MD5 digest becomes 32 hex characters. Base64 encoding packs 3 bytes into 4 characters from a 64-character alphabet plus '=' padding, so the same 16-byte MD5 digest becomes 24 Base64 characters. The same underlying hash looks different depending on which encoding was used to display it.
Why do MD5 and NTLM hashes look identical?
Both MD5 and NTLM produce a 128-bit digest, so both are displayed as 32 hexadecimal characters with no distinguishing prefix. Length and character set alone cannot tell them apart; you would need context (where the hash came from) or a known plaintext-to-hash pair to confirm which algorithm produced it.

Related calculators