Free hash identifier. Paste a hash to identify MD5, SHA-1, SHA-256, bcrypt, NTLM and more, with the exact hashcat -m mode and John the Ripper format.
Paste one or more hashes and this tool tells you which algorithm most likely produced them, together with the exact hashcat mode (-m) and John the Ripper format name you need to start cracking. It recognises raw hex digests (MD5, SHA-1, SHA-224/256/384/512, SHA-3, RIPEMD, Whirlpool), Windows hashes (NTLM, LM, NetNTLMv1/v2), Unix crypt formats (md5crypt, sha256crypt, sha512crypt, bcrypt, yescrypt, scrypt, Argon2), and application formats (phpass/WordPress, Django, LDAP SSHA, MySQL).
Everything runs in your browser. Nothing is uploaded, which matters when the hashes come from an authorised engagement.
Many hashes are simply a fixed-length hex string, and length is often the only structural signal available. A 32-character hex string could be MD5, NTLM, MD4, or half of an LM hash — they are mathematically indistinguishable by inspection. A 64-character hex string could be SHA-256, SHA3-256, Keccak-256, or several others.
Rather than guess one answer and be wrong, this tool lists every plausible candidate ordered by likelihood. High-confidence matches (structured formats like bcrypt's $2b$ prefix, or the overwhelmingly common raw SHA-256) come first; lower-probability algorithms of the same length follow. In practice you narrow it down from context: a 32-hex hash from a Windows SAM dump is NTLM, the same string from a web application database is far more likely to be MD5.
This is the single most common identification question, and it is why context beats pattern matching. Both are 32 hex characters. If the hash came from secretsdump, a domain controller, or a user:rid:lm:nt::: line, it is NTLM (hashcat -m 1000). If it came from a web app, a leaked database, or a hash($password) call, it is almost certainly MD5 (hashcat -m 0). The tool surfaces both and explains the distinction rather than hiding it.
Where a hash carries a prefix or internal structure, identification is reliable. $2a$/$2b$/$2y$ is bcrypt. $1$ is md5crypt, $5$ is sha256crypt, $6$ is sha512crypt. $argon2id$ is Argon2. $P$ or $H$ is phpass, the format WordPress and phpBB use. {SSHA} is salted SHA-1 from an LDAP directory. The NetNTLMv2 challenge-response format has a distinctive multi-field layout that pins it exactly. For these, the tool returns a single high-confidence answer.
Each candidate shows a copyable hashcat -m <mode> fragment and the corresponding john --format=<name>. Some modern password hashes — Argon2 and yescrypt in particular — are intentionally memory-hard and have no mainstream cracking support; the tool says so rather than implying a mode exists.
Hash identification is a standard step in penetration testing, incident response, and capture-the-flag challenges. Use this on hashes you are authorised to assess. To check whether a file hash is associated with known malware, use the Hash Lookup tool; to identify a classical cipher rather than a hash, use the Cipher Identifier.