BYTETOOLS

Hash Identifier

Paste a hash and find out what it probably is. Identifies MD5, SHA-1, SHA-256, NTLM, bcrypt, APR1 and more from length, character set and prefix.

What is the Hash Identifier?

A hash identifier guesses which algorithm produced a digest by looking at its length, its character set and any prefix. A 32-character hex string is almost certainly MD5 or NTLM; a string starting with $2y$ is bcrypt.

  • Recognises MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 and CRC-32
  • Detects bcrypt, Argon2, yescrypt, scrypt, MD5-crypt and APR1 prefixes
  • Handles LDAP {SHA}, {SSHA}, {MD5} and Django-style formats
  • Spots NTLM, LM:NTLM pairs and MySQL password hashes
  • Identifies Base64-encoded digests by their decoded byte length
  • Explains the reasoning behind every candidate

How to use the Hash Identifier

  1. 1

    Paste a single hash into the input box.

  2. 2

    Read the length, structure and character set the tool detected.

  3. 3

    Work down the candidate list — high confidence entries appear first.

  4. 4

    Check the reasoning next to each candidate against what you know about the source system.

  5. 5

    Split composite values such as hash:salt and identify each part separately.

About the Hash Identifier

The ByteTools Hash Identifier tells you what an unknown digest most likely is. Paste the value and it reports the candidates ranked by confidence, with the reasoning shown so you can judge for yourself rather than trusting a single guess.

It recognises the modular-crypt prefixes that give the answer away — $2y$ for bcrypt, $apr1$ for Apache, $6$ for SHA-512 crypt, $argon2id$ for Argon2 — as well as LDAP scheme tags like {SHA}, MySQL's asterisk form, LM:NTLM pairs, and the hex and Base64 lengths of every common digest.

The rules run entirely in your browser, so the hash you paste is never uploaded or logged. That is worth caring about: a hash from a real system is sensitive material, and handing it to a remote service is how a routine investigation turns into a disclosure.

Frequently asked questions

Can you tell MD5 and NTLM apart?

Not from the hash alone — both are 128-bit digests written as 32 hex characters. Context decides it: a hash pulled from a Windows domain controller is NTLM, one from a web application database is far more likely MD5.

Does this tool crack or reverse the hash?

No. Hashing is one-way by design, and nothing here attempts to recover the original input. It only tells you which algorithm the value probably came from so you know what you are dealing with.

Why does my hash match several algorithms?

Because length is often the only clue available. SHA-256, SHA3-256, Keccak-256 and BLAKE2s all produce 64 hex characters and are indistinguishable from the output alone. The candidate list is ordered by how commonly each one turns up in practice.

What does a hash beginning with $2y$ mean?

It is bcrypt. The prefix is followed by a cost factor, then a 22-character salt and the digest, always adding up to 60 characters. $2a$ and $2b$ are the same algorithm with different historical version markers.

My hash is not recognised — what now?

It may be truncated, salted with the salt stripped off, encoded rather than hashed, or produced by a proprietary scheme. Check whether it decodes as Base64 or hex, and look at how the source application stores passwords before assuming an algorithm.

Related tools