Can this tool tell me for certain which algorithm produced a hash?

No, and no length-or-format-based tool can. Many algorithms produce identically-shaped output (MD5 and NTLM are both 32 hex characters; SHA-256 and SHA3-256 are both 64), so this tool reports every format that plausibly matches, with a confidence level, rather than a single guaranteed answer. Hashes with a distinctive prefix like $2b$ (bcrypt) or $6$ (SHA-512 crypt) get a high-confidence single match; bare hex or base64 digests get every length-matching candidate.

Why do some matches say 'high' confidence and others 'medium'?

High confidence means the hash matched a distinctive, hard-to-confuse prefix or structure, like bcrypt's $2b$ $ format. Medium confidence means the match is based on length alone, where more than one common algorithm produces output of exactly that length, so it's a plausible guess rather than a near-certain identification.

What does 'Unrecognized format' mean?

It means the input didn't match any known prefix, and its length or character set doesn't correspond to a common hash's raw hex or base64 output. It could be a less common algorithm, a truncated or corrupted hash, an encoded value that isn't a hash at all, or a hash with a custom application-specific prefix.

Does this tool attempt to crack or reverse the hash?

No. It only inspects the hash string's shape to guess which algorithm produced it; it never attempts to find the original input.

Password Hash Identifier - Guess the Algorithm From a Hash

Overview

Introduction

Finding a bare hash string in an old database dump or config file rarely comes with a label saying which algorithm produced it.

This tool inspects the string's prefix, structure, and length and reports every password-hash or digest format that plausibly matches, entirely in your browser.

What Is Password Hash Identifier?

A heuristic hash-format identifier: it checks a pasted string against distinctive prefixes (bcrypt's $2b$, glibc crypt's $1$/$5$/$6$, Argon2's $argon2id$, phpass's $P$/$H$, MySQL's leading *, LDAP's {SSHA}/{SHA}) first, then falls back to length-based guessing for bare hex or base64 strings.

It reports every plausible match with a confidence level rather than pretending length alone can uniquely identify an algorithm.

How Password Hash Identifier Works

The input is tested against a list of regular expressions for known formats with distinctive structure; any match is reported at high confidence since these prefixes are essentially unambiguous.

If nothing distinctive matches, the string's length is checked against known raw digest sizes for both hex (32/40/56/64/96/128 characters) and base64 (24/28/44/64/88 characters) encodings, reporting every algorithm whose output happens to be that length, at medium confidence when more than one algorithm shares that length.

When To Use Password Hash Identifier

Use it when you've found a hash string (in a config file, database export, or old codebase) and need a starting guess for what algorithm produced it, before trying to verify or migrate it.

It's also a quick way to sanity-check that a hash your own code just generated actually looks like the algorithm you intended.

Often used alongside Bcrypt Hash Analyzer and Hash Generator.

Features

Advantages

Covers both distinctively-prefixed formats and bare hex/base64 digests, rather than only one or the other.
Reports confidence levels honestly, including every plausible length-based match instead of a single potentially-wrong guess.
Explains why each match was made, including when a length is inherently ambiguous between two algorithms.

Limitations

Length- and format-based identification is inherently ambiguous for algorithms that share an output shape; it cannot distinguish, for example, MD5 from NTLM by content alone.
Doesn't recognize every possible hash format in existence, especially application-specific custom prefixes.

Examples

Identifying a bcrypt hash

Input

$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy

Output

bcrypt (high confidence)

The $2b$10$ prefix and 60-character total length exactly match bcrypt's structure, so this is reported at high confidence with no other candidates.

Identifying a bare 32-character hex string

Input

5f4dcc3b5aa765d61d8327deb882cf99

Output

MD5 (medium confidence), NTLM (medium confidence)

32 hex characters matches both MD5 and NTLM's digest length exactly, so both are reported rather than an overconfident single guess.

Best Practices & Notes

Best Practices

Treat a medium-confidence match as a starting hypothesis to verify (e.g. by trying to reproduce it against known plaintext), not a certainty.
Check the source system's documentation or code when it's available; it's a far more reliable source than format-guessing for an ambiguous hash.
If migrating hashes to a new system, confirm the algorithm before writing any verification code around a guessed format.

Developer Notes

Distinctive-format checks run as an ordered list of regular expressions before any length-based fallback, since a $2b$-prefixed bcrypt hash also happens to be a fixed 60 characters and shouldn't fall through to a length-based hex/base64 guess. Length tables map hex/base64 output lengths to every common algorithm producing that length, deliberately including cases like MD5/NTLM (both 32 hex) and SHA-256/SHA3-256 (both 64 hex) as multiple medium-confidence results rather than picking one arbitrarily.

Password Hash Identifier Use Cases

Identifying an unlabeled hash found in a config file, database dump, or old codebase
Sanity-checking that your own code generated the hash format you expected
Learning to recognize common password-hash format prefixes like $2b$, $6$, and $argon2id$

Common Mistakes

Treating a medium-confidence, length-based match as definitive when multiple algorithms share that exact output length.
Assuming every hash has a distinctive prefix; many legacy systems store bare hex or base64 digests with no format marker at all.

Tips

Check the surrounding context (a database column name, a config key, or nearby documentation) alongside this tool's output; it's often more reliable than format-guessing alone for ambiguous lengths.

Password Hash Identifier