Hash Identifier
Hash Identifier
Paste a hash. This page guesses the algorithm from length and prefix and maps Hashcat / John modes. It does not reverse hashes. Nothing is sent to a server.
Authorized testing only. Identification is not cracking. If this is a JWT, use the JWT decoder.
Paste a hash. This tool names likely algorithms from length and prefix, then maps Hashcat -m and John –format. It does not reverse hashes, does not search rainbow tables, and does not upload the string. Use Hashcat or John only on hashes you are authorized to test.
If the paste is eyJ…, stop — that is a JWT. Use the JWT Decoder.
How this hash identifier works
- Prefix rules fire first ($2y$, $argon2id$, $P$, $6$, *, eyJ).
- If it is hex, length decides: 32, 40, 64, 128 are the usual suspects.
- Several algorithms share a length. MD5, NTLM, and MD4 are all 32 hex. The tool lists them with confidence. Context (web app dump vs Windows SAM) picks the winner.
- Copy the Hashcat mode. Wrong -m wastes a GPU night.
Click Sample WordPress if you administer WP. User hashes in wp_users start with $P$ (phpass). Hashcat mode 400.
Common fingerprints
- 32 hex characters — MD5, NTLM, or MD4 (modes 0 / 1000 / 900). File checksums are usually MD5. Windows dumps are NTLM.
- 40 hex characters — SHA-1 (mode 100). Collision-broken; still in old git and certs.
- 64 hex characters — SHA-256 (mode 1400). Default modern checksum.
- Prefix 2a, 2b, or 2y — bcrypt (mode 3200). Cost factor sits in the string.
- Prefix argon2id — Argon2 (mode 34000). What you should migrate to.
- Prefix P or H — WordPress / phpass (mode 400). CMS user-password column.
- Prefix 6 — sha512crypt (mode 1800). Typical Linux shadow hash.
- Prefix eyJ — JWT. Not a password hash. Use the decoder.
A 32-character hex string is not “definitely MD5.” That is the whole reason this page exists.
This tool will not decrypt your hash
Hashing is one-way. Online “hash decoders” that spit a password are looking the digest up in a leaked-password table. That is a different product, often a different legal problem, and a bad idea next to AdSense. CodeCrackers stops at identification.
Related: JWT Decoder, Secure Password Generator.
What this tool will not do
- Crack, brute-force, or rainbow-table lookup
- Tell MD5 from NTLM without context
- Identify every salted / truncated / vendor-specific encoding
- Replace hashcat –identify on a full dump file
FAQ — Rank Math FAQ block
Q: Can this reverse a hash?
A: No. Hashes are one-way. Identification only names likely algorithms.
Q: Why are MD5 and NTLM both listed?
A: They share digest length (32 hex). File checksums are usually MD5. Windows SAM / NTDS dumps are NTLM. Hashcat modes 0 vs 1000.
Q: What does hashcat -m mean?
A: The mode number for that algorithm. Example: 0 is raw MD5, 3200 is bcrypt, 400 is WordPress phpass.
Q: Is a WordPress password an MD5?
A: Not on modern WP. user_pass is phpass ($P$), Hashcat 400. Old plugins might still store MD5. Paste the actual string.
Q: I pasted a JWT.
A: Use the JWT decoder. Hashcat will not help.