How to use the hash format identifier
- Paste one hash string per line. The box starts with example strings, so replace them with your own.
- Read the table: each line shows the best guess, the details read from the string and any other formats the same string could be.
- For strings that carry a prefix, such as $2b$ or $argon2id$, check the cost, memory or rounds shown in the details column.
- Copy the result or download the table as a CSV file.
Formula
prefix formats: match $2b$, $argon2id$, $5$, $6$, $apr1$, $P$, pbkdf2 and scrypt layouts and read their fields
plain digests: hex length x 4 = bits, then list the algorithms of that size
Base64 digests: bytes = length x 3 / 4, less padding
A 32 digit hex string has 128 bits, a 40 digit string 160 bits, a 64 digit string 256 bits and a 128 digit string 512 bits. The first name listed for a length is the most common one, not a proof.
Five strings, five kinds
The line 5d41402abc4b2a76b9719d911017c592 has 32 hex digits, so it is listed as MD5 first, with MD4, NTLM and others as other possibilities. A 40 digit string is SHA-1 first, and a 64 digit string is SHA-256 first.
The string $2b$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW is bcrypt with a cost of 12, meaning 2^12 = 4096 rounds, a 22 character salt and a 31 character hash. In the example list 7 of 8 lines are recognized and the text "not a hash" is not.
What a match means
Many different algorithms produce output of the same size, so a plain digest can only be narrowed to a short list. A 32 digit hex string might be MD5, but it might equally be a truncated hash or a value from an unrelated system. Strings with a prefix are far more reliable, because the prefix is part of the format.
Nothing here tells you the original password or text, and the page never tries to guess one. To create hashes yourself, see the Hash Generator, the HMAC Generator and the bcrypt Hash Generator.
Choosing a format for new work
For storing passwords, use a slow salted function such as bcrypt or Argon2. Fast digests like MD5 and SHA-1 should not protect passwords, although they remain common for file checks. If a hash you find turns out to be a fast digest of a password, consider asking whoever runs the system to move to a slower scheme.
Assumptions and limits
- The page looks only at the shape of each string: its prefix, its length and its characters.
- Up to 200 strings can be checked at once, each trimmed of spaces at the ends.
- Salts and hashes inside password strings are never decoded or compared with anything.
- Upper and lower case hex are both accepted, and the result is the same.
- The list of formats is limited to the common ones and a string in an unlisted format shows as No match.
Frequently asked questions
Why does the page give several answers for one hash?
Several algorithms share an output size. SHA-256, SHA3-256 and BLAKE2s-256 are all 64 hex digits, so the length alone cannot separate them. The first answer is the most common.
What does the cost number in a bcrypt hash mean?
It is the base 2 logarithm of the number of rounds. A cost of 12 means 4,096 rounds, and each step up doubles the work.
Can the page tell me the password behind a hash?
No. It only describes the format, and it holds no list of passwords or leaked hashes.
Why is a string with the right length marked No match?
Only certain lengths and formats are on the list. A 50 digit hex string, for example, matches no common digest, so it is more likely something else, such as a mistake in copying.