Hash Identifier

Introduction

You found a hash in a database dump, a config file, a password breach list — but which algorithm produced it? This tool answers that question instantly. Paste any hash and it detects the likely algorithm by analyzing length, character set, and structural prefixes. From MD5's 32-character hex strings to bcrypt's structured $2a$ prefixes, this identifier covers the algorithms you'll encounter in the real world.

What This Tool Does

A hash identifier detects the probable cryptographic algorithm used to produce a given hash string through pattern matching analysis. It examines the hash's length (MD5=32 hex, SHA-1=40, SHA-256=64, SHA-512=128), character composition, and structural prefixes (bcrypt starts with $2a$, Argon2 with $argon2id$). The tool assigns confidence scores to each match, distinguishing between high-confidence identifications (bcrypt at 99%) and ambiguous cases (MD5 vs NTLM, both 32 hex characters). This is pattern-based identification — not definitive proof — so context matters.

Why It Matters

How It Works

The identifier runs a series of regex tests and length checks against the input string. It first checks for structured prefixes: bcrypt ($2a$, $2b$, $2x$, $2y$), Argon2 ($argon2i$, $argon2id$, $argon2d$), scrypt ($scrypt$), and PBKDF2 ($pbkdf2-$). These patterns are highly specific and yield 90-99% confidence. For plain hex hashes, it measures length: 32 chars = MD5, 40 = SHA-1, 56 = SHA-224, 64 = SHA-256, 96 = SHA-384, 128 = SHA-512. The tool also handles ambiguous cases like NTLM (same format as MD5) by reporting lower confidence and noting that context is needed for definitive identification.

Step-by-Step Examples

Code Examples

function identifyHash(hash) {
  const patterns = [
    { name: 'MD5', test: h => /^[a-f0-9]{32}$/i.test(h), confidence: 95 },
    { name: 'SHA-1', test: h => /^[a-f0-9]{40}$/i.test(h), confidence: 95 },
    { name: 'SHA-256', test: h => /^[a-f0-9]{64}$/i.test(h), confidence: 95 },
    { name: 'SHA-384', test: h => /^[a-f0-9]{96}$/i.test(h), confidence: 95 },
    { name: 'SHA-512', test: h => /^[a-f0-9]{128}$/i.test(h), confidence: 95 },
    { name: 'bcrypt', test: h => /^$2[abxy]$/.test(h), confidence: 99 },
    { name: 'Argon2', test: h => /^$argon2(id|i|d)$/.test(h), confidence: 99 }
  ];
  
  return patterns
    .filter(p => p.test(hash))
    .sort((a, b) => b.confidence - a.confidence);
}

Benefits

• Instantly identifies hash type by length and pattern matching.
• Detects Argon2, bcrypt, scrypt, and PBKDF2 password hash prefixes.
• Reports confidence level to help assess identification reliability.
• Handles ambiguous cases by reporting multiple possible matches.
• Client-side operation with zero network transmission.

Use Cases

Common Mistakes to Avoid

Security Implications

Security Information

Identification is performed entirely client-side. No hash values are transmitted. Hash type identification is a useful first step in security audits to verify the correct algorithm is in use. However, identification is probabilistic — always verify through source code review or configuration documentation for definitive confirmation.

Best Practices

• Use this tool to verify your application is using the expected hash algorithm.
• If an application returns MD5 hashes for passwords, it should be upgraded to bcrypt or Argon2 immediately.
• Remember that identification is probabilistic — the same length can correspond to multiple algorithms.
• Check for algorithm prefixes ($2b$, $argon2id$) for the highest confidence identifications.
• Combine hash identification with source code review for definitive security assessments.