Hash Identifier
Hash Identifier
-m modes and John the Ripper formats. Runs 100% in your browser.Authorized security testing only. Identification is not cracking. If your string starts with eyJ, it is a JSON Web Token. Use our JWT Decoder.
Identify any unknown hash string instantly with this free online hash identifier. Paste a hash below to determine its underlying algorithm based on character length, prefix signatures, and encoding rules. This tool automatically maps the exact hashcat -m modes and john --format flags needed for security audits and penetration testing. Refer to official Hashcat Example Hashes and the John the Ripper Documentation for complete mode references.
Also explore our JWT Decoder and JSON Formatter for additional developer tools.
How This Hash Identifier Works
- Paste the hash string into the input box above.
- Prefix pattern rules run first. Hashes starting with
$2y$(bcrypt),$argon2id$(Argon2),$P$(WordPress), or$6$(SHA-512 crypt) are identified instantly with high confidence. - Hexadecimal character length evaluation runs next. MD5 (32 chars), SHA-1 (40 chars), SHA-256 (64 chars), and SHA-512 (128 chars) are mapped to their respective algorithm families.
- Review the candidate list. Copy the exact
hashcat -morjohn --formatcommand string for your security benchmarks.
Common Hash Lengths and Algorithms Quick Reference
| Length (Hex) | Likely Algorithm | Hashcat Mode (-m) | John Format |
|---|---|---|---|
| 32 chars | MD5 / NTLM / MD4 | -m 0 (MD5) / -m 1000 (NTLM) | raw-md5 / nt |
| 40 chars | SHA-1 / RIPEMD-160 | -m 100 (SHA-1) / -m 6000 | raw-sha1 |
| 56 chars | SHA-224 | -m 1300 | raw-sha224 |
| 64 chars | SHA-256 / SHA3-256 | -m 1400 | raw-sha256 |
| 96 chars | SHA-384 | -m 10800 | raw-sha384 |
| 128 chars | SHA-512 / Whirlpool | -m 1700 (SHA-512) | raw-sha512 |
| $2y$ / $2b$ | bcrypt | -m 3200 | bcrypt |
| $P$ / $H$ | WordPress phpass | -m 400 | phpass |
Why Hash Identification Matters for Pentesters
Selecting the wrong algorithm mode in Hashcat wastes GPU computation cycles. For example, running an NTLM hash list under mode -m 0 (MD5) produces zero matches because NTLM uses UTF-16LE encoding internally. Identifying prefix signatures like $P$ or $2a$ beforehand ensures you pass the exact parameters to your authorized audit framework.
Important Note on Web Tokens
If your string starts with eyJ and contains dot-separated sections, it is a JSON Web Token (JWT) rather than a password hash. Passwords should never be hashed as plain JWTs. Use our dedicated JWT Decoder Tool to parse its header and payload claims.
Check out our full Free Tools Directory for more cybersecurity and developer utilities.