How does this tool detect the hash type?

The detector uses three signals. First it checks for a distinctive format prefix — bcrypt hashes start with `$2b$`, Argon2id with `$argon2id$`, and Unix crypt with `$1$`/`$5$`/`$6$`. These prefixed formats are identified definitively. For unprefixed hex hashes (MD5, SHA-1, SHA-256, etc.) the detector checks the character set (must be hexadecimal 0-9 a-f) and then matches the character count: 32 chars points to MD5-family, 40 to SHA-1-family, 64 to SHA-256-family, and so on.

Why are multiple hash types listed for the same input?

Several algorithms produce output of the same length. A 32-character hex string could be MD5, NTLM, RIPEMD-128, LM Hash, MD4, or MD2 — there is no way to distinguish them from the value alone without additional context like "this came from a Windows domain controller" (likely NTLM) or "this is a file checksum" (likely MD5). The tool lists all possibilities so you can narrow down using context. Prefixed formats like bcrypt and Argon2 are always identified uniquely.

Can this tool crack or reverse-engineer a hash?

No. Hash functions are one-way by design — they cannot be reversed. This tool only identifies the algorithm that produced a given hash, not the original input. To find the original input you would need a precomputed lookup table (rainbow table) or brute-force search, which this tool does not perform.

Does the tool handle bcrypt, Argon2, and Unix crypt password hashes?

Yes. Password hashing formats that embed metadata in their output — bcrypt (`$2b$cost$salt+hash`), Argon2id (`$argon2id$v=19$m=…`), Unix MD5 crypt (`$1$salt$hash`), Unix SHA-512 crypt (`$6$salt$hash`), and PBKDF2 variants — are detected by their distinctive prefix with high confidence, regardless of the encoded hash length.

Is it safe to paste a password hash here?

All processing runs entirely in your browser — the hash string is never sent to a server. No data is logged, stored, or transmitted. That said, if a hash represents a user's password and you are working in a security-sensitive context, be mindful of who can see your screen and what your browser history retains.

Identify hash types in a leaked database dump

You're analyzing a breach dump and find a column of 32-character hex strings. Paste one into the detector — if only MD5 or NTLM are listed you know the passwords were hashed without a salt, making them crackable with rainbow tables. If it's bcrypt or Argon2id you can confirm the application stored passwords correctly with a proper KDF.

Confirm a third-party library's password storage format

You're auditing an auth library and want to verify it uses bcrypt rather than plain MD5. Sample a hash from its output, paste it here, and the `$2b$` prefix confirms bcrypt with the embedded cost factor — no need to read the library source.

Hash Type Detector — Identify Any Hash Algorithm Instantly

Paste any hash string and instantly identify MD5, SHA-256, bcrypt, Argon2, and 30+ other formats

Runs locally
Category Encoding & Crypto
Best for Checking file type, size, metadata, and obvious mismatch signals before sharing.

Paste a hash string

Supports: MD5 · SHA-1/224/256/384/512 · SHA-3 · bcrypt · Argon2 · NTLM · RIPEMD · Blake2 · Whirlpool · CRC32 · and more

What this tool does

Free online hash type identifier. Paste any hash string and instantly learn which algorithm produced it — MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA-3, bcrypt, Argon2, NTLM, RIPEMD, Blake2, CRC32, and 30+ more. Detection works by analyzing the hash length, character set, and format prefix. 100% client-side — your hash never leaves the browser.

Tool details

Input: Text; The page exposes text boxes, numeric controls, file pickers, or structured inputs depending on the tool.
Output: Live result + Copy; The result area focuses on usable output, with copy, download, or preview actions when supported.
Privacy: Browser-side processing; The main tool logic does not call an external API, so inputs normally stay in the current tab.
Save / share: No account required; Open the page and use it; whether results survive refresh depends on the tool.
Performance budget: Initial JS <= 8 KB; No WASM budget is declared, keeping the tool quick to open on mobile.
Best fit: Encoding & Crypto · Developer; Category and role tags drive related tools, internal links, and quick fit checks.

How to use

1. Input

Paste or drop your content into the tool panel.
2. Process

Click the button. All processing is local in your browser.
3. Copy / Download

Copy the result or download to disk in one click.

How Hash Type Detector fits into your work

Use it before upload, handoff, archive, support review, or any moment where a file needs one local check before it leaves your machine.

File jobs

Checking file type, size, metadata, and obvious mismatch signals before sharing.
Preparing mixed folders for upload, archive, intake, or review.
Keeping sensitive files in the browser instead of sending them to an account-based service.

File checks

Do not treat the extension alone as proof of the real file type.
Review metadata before a file goes to customers, vendors, or a public page.
Keep the original file until the copied, converted, or exported result is verified.

Good next steps

These links move the current task into a more complete workflow.

Real-world use cases

Identify hash types in a leaked database dump
You're analyzing a breach dump and find a column of 32-character hex strings. Paste one into the detector — if only MD5 or NTLM are listed you know the passwords were hashed without a salt, making them crackable with rainbow tables. If it's bcrypt or Argon2id you can confirm the application stored passwords correctly with a proper KDF.
Confirm a third-party library's password storage format
You're auditing an auth library and want to verify it uses bcrypt rather than plain MD5. Sample a hash from its output, paste it here, and the `$2b$` prefix confirms bcrypt with the embedded cost factor — no need to read the library source.

Common pitfalls

Assuming every 32-char hex string is MD5. NTLM, RIPEMD-128, MD4, LM Hash, Tiger-128, and Haval-128 all produce 32 hex chars.
Pasting a hash with surrounding whitespace. A leading or trailing space changes the character count and can cause "no match" — always trim before pasting.
Treating detection as verification. This tool identifies plausible types by structure, not by computing and comparing the hash from known plaintext.

Privacy

Detection runs entirely in your browser using regex pattern matching and character counting. Your hash string is never sent to a server. No data is logged, stored, or written to the URL.

FAQ

Tool combos

Folks in your role tend to reach for these alongside this tool.

Browse all tools for this role

Hash Type Detector — Identify Any Hash Algorithm Instantly

What this tool does

Tool details

How to use

1. Input

2. Process

3. Copy / Download

How Hash Type Detector fits into your work

File jobs

File checks

Good next steps

Real-world use cases

Identify hash types in a leaked database dump

Confirm a third-party library's password storage format

Common pitfalls

Privacy

FAQ

MD5 / SHA Hash Generator

JWT Decoder

Base64 Encoder & Decoder

Bcrypt Generator

HMAC Generator

AES Text Encryptor

Affine Cipher Encoder & Decoder

Atbash Cipher

Bacon Cipher Encoder & Decoder

Base32 / Base58 Encoder & Decoder

Base62 Encoder & Decoder

Base64 Block Deduplicator