A cryptographic hash function turns any input into a fixed-size fingerprint. Change one character of the input and roughly half of the output bits flip, and there is no practical way to run the function backwards – which makes hashes ideal for checking file integrity, signing data and storing passwords. Because each function always produces the same length, the length of a hash is the first clue to its type: 32 hexadecimal characters (128 bits) points to MD5 or NTLM, 40 to SHA-1, 64 to SHA-256 and 128 to SHA-512.
Length alone is ambiguous – SHA-256, SHA3-256 and BLAKE2s all give 64 hex digits – so the identifier lists every candidate, most common first. Password hashes are easier: modern schemes store the algorithm in a prefix, such as $2b$12$ for bcrypt with cost 12, $6$ for SHA-512 crypt on Linux, $argon2id$ for Argon2 or $P$ for WordPress phpass. The tool also recognises Base64-encoded digests, LDAP {SHA} values, MySQL’s *-prefixed hashes and hash:salt pairs.
Nothing is hashed or sent anywhere – the analysis is pattern matching in your browser. Identification tells you what you have; to know which plaintext produced the hash you would need the original data, which is the whole point of a one-way function.
How to use the Hash Identifier
- Hash
Everything is calculated in your browser, so results appear instantly and nothing you type is sent to a server.
How it works
The input is checked against about 20 prefix patterns (modular crypt format and vendor formats) first. If none matches and the string is hexadecimal, candidates are taken from a table of digest lengths; Base64 strings are converted to their byte length; hash:salt pairs are split at the colon.
Worked example
The string 5d41402abc4b2a76b9719d911017c592 has 32 characters, all lowercase hexadecimal. 32 × 4 = 128 bits, the digest size of MD5, NTLM, MD4 and a few rarer functions, so MD5 – by far the most common – is listed first. (It is in fact the MD5 of “hello”.) A 60-character string starting with $2b$12$ is recognised directly as bcrypt with cost 12.
Hash lengths at a glance
| Algorithm | Bits | Hex characters | Base64 characters |
|---|---|---|---|
| CRC-32 | 32 | 8 | 8 |
| MD5 / NTLM | 128 | 32 | 24 |
| SHA-1 | 160 | 40 | 28 |
| SHA-224 | 224 | 56 | 40 |
| SHA-256 / SHA3-256 | 256 | 64 | 44 |
| SHA-384 | 384 | 96 | 64 |
| SHA-512 / SHA3-512 | 512 | 128 | 88 |
Formula
Digest size (bits) = hex characters × 4 = bytes × 8
MD5 = 32 hex (128 bits) · SHA-1 = 40 (160) · SHA-256 = 64 (256) · SHA-512 = 128 (512) · bcrypt = $2b$ + cost + 53 characters
Worked example
Inputs — Hash: 5d41402abc4b2a76b9719d911017c592.
Results — Most likely algorithm = MD5; All candidates = 1. MD5 – most common 128-bit hash – broken for collisions
2. NTLM (NT hash) – Windows password hash = MD4 of UTF-16LE password
3. MD4 – obsolete
4. LM hash – old Windows, usually uppercase
5. RIPEMD-128
6. MD2 – obsolete
7. Tiger-128
8. xxHash128 / MurmurHash3 128-bit – non-cryptographic; Digest size = 128 bits; Length = 32 characters; Character set = hexadecimal (lowercase); Security note = Not suitable for storing passwords or for new security designs..
Key terms
- Hash function
- A one-way function mapping any input to a fixed-size digest.
- Digest
- The output of a hash function.
- Salt
- Random value combined with a password before hashing.
- Modular crypt format
- The $id$salt$hash notation used by Unix password hashes.
Frequently asked questions
How can I tell if a hash is MD5?
An MD5 hash is 32 hexadecimal characters (128 bits), e.g. 5d41402abc4b2a76b9719d911017c592 = MD5 of “hello”. NTLM has the same length, so context matters.
How long is a SHA-256 hash?
64 hexadecimal characters, or 44 characters in Base64.
What does $2b$12$ mean?
bcrypt (version 2b) with a cost factor of 12, i.e. 2¹² = 4,096 rounds of key expansion.
Can a hash be decrypted?
No – hashing is one-way. Weak or unsalted password hashes can be guessed with dictionaries and rainbow tables, which is why fast hashes like MD5 are unsuitable for passwords.
Why can’t the tool be certain?
Different algorithms produce digests of the same length and alphabet; only prefixes or context identify them uniquely.
What is a salt?
Random data added to each password before hashing so identical passwords get different hashes; it is often stored next to the hash, e.g. hash:salt.
Which hash should I use for passwords?
A slow, salted function: Argon2id, scrypt, bcrypt or PBKDF2, as recommended by OWASP and NIST.