You have found a hash in a log file, a database dump, a configuration file or a security report, and now you need to know what it is before you can do anything with it. Hashes do not label themselves — but they do leave fingerprints: their length, their character set, and sometimes a distinctive prefix. A 32-character hexadecimal string is almost certainly MD5, a 64-character one is probably SHA-256, a string starting with $2y$ is bcrypt, and a 40-character hex string is SHA-1. This identifier reads those fingerprints and returns the most likely algorithms, ranked, with a short explanation of each guess. It cannot prove a hash type with certainty — different algorithms can share a length — but it narrows a mystery digest to a short list in seconds, which is exactly the starting point for verification, cracking research or incident response.
Quick Answer: Paste a hash digest and get its most likely algorithms, identified from length, character set and known prefixes.
Free Online Tool
Hash Type Identifier
How to Use the Hash Type Identifier
- Paste the hash digest into the input box.
- Press Identify Hash and read the ranked list of likely algorithms.
- Check the explanation for each candidate, including its length and format clues.
- Test the top candidate by hashing a known value and comparing.
- If several candidates remain, use context — the system that produced the hash — to decide.
Key Features
- Identifies MD5, SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512 by length
- Recognises bcrypt, Argon2, scrypt and other prefixed formats
- Explains the clues behind every guess
- Handles upper and lower case hex, plus common encodings
- Free, instant and entirely in your browser
Best Practices and Tips
- Length is the strongest clue: count the characters before anything else, since most hashes have a fixed length.
- Prefixes settle many cases instantly: $2y$, $argon2 and $scrypt$ name their algorithm outright.
- When two algorithms share a length, context decides — check what software produced the hash.
- A hash that is not hexadecimal is probably encoded differently, such as Base64, which changes its apparent length.
- Use the identifier as a starting hypothesis, then confirm by hashing a known input with the suspected algorithm.
Common Mistakes to Avoid
- Treating the top guess as certain when several algorithms share the same digest length.
- Forgetting that salts, peppers and encodings change a hash appearance without changing its algorithm.
- Assuming a short hash is weak and a long hash is strong: length alone does not determine security.
- Trying to “decode” a hash: hashes are one-way, and identification only names the algorithm, never the input.
Frequently Asked Questions
How does hash identification work?
It compares the digest against known patterns: the length in characters, whether it uses hexadecimal or another alphabet, and any distinctive prefix. Each matching algorithm is listed with the clues that support it, most likely first.
Can a hash type be identified with certainty?
Not always. MD5 and other 128-bit hashes share a 32-character length, and SHA-256 shares its 64-character length with other 256-bit hashes. The tool gives ranked candidates; confirming a guess requires hashing a known value and comparing digests.
What does a $2y$ prefix mean?
It marks a bcrypt hash. Bcrypt, Argon2, scrypt and similar password hashes embed their algorithm, cost and salt in the stored string itself, which makes them self-describing — unlike bare hexadecimal digests.
Why is my hash not recognised?
It may be encoded in Base64 rather than hex, truncated, salted, or from an algorithm outside the common set. Check the raw length and character set, and consider whether the value is a hash at all rather than an encoded token.
Is the hash identifier free?
Yes — free, unlimited and no sign-up required.