Hash identifier
Recognise a hash by its format. It is analysed in your browser, and nothing is sent anywhere.
Nothing leaves your browser: the hash is analysed on this device and never sent or looked up.
What it tells you
Paste a hash and the tool names the algorithm it most likely came from, based on its length, character set and any format markers. Some formats are unmistakable: bcrypt, Argon2 and the Unix crypt schemes carry a prefix such as $2b$ or $argon2id$. Others are only recognisable by shape, so a 32-character hex string could be MD5, NTLM or a few less common algorithms, and the tool lists them all.
It recognises a hash; it does not reverse one. Nothing you paste is sent anywhere or looked up against a database.
Why the algorithm matters
If you find these hashes in your own application or database, the algorithm tells you whether passwords are stored safely. Fast hashes like MD5, SHA-1 and plain SHA-256 are built for speed, which is exactly what an attacker wants when guessing billions of passwords. Password hashes should be slow and salted: bcrypt, scrypt or Argon2.
Questions
Can you tell me the original value?
No. A hash is one-way by design, and this tool only identifies the algorithm. It never reverses or looks up a hash.
Why does it list several algorithms?
Many algorithms produce output of the same length and character set. A 32-character hexadecimal string, for example, matches MD5, NTLM and others. Format markers (like the $2b$ in bcrypt) are what allow an exact answer.
I found SHA-256 password hashes. Is that fine?
Plain SHA-256 is too fast for passwords. Use a slow, salted algorithm such as bcrypt, scrypt or Argon2, and migrate existing hashes as users next sign in.
Need more than a tool can show?
A tool checks one thing. Our consultants look at the whole picture.
Secure softwareRelated articles
-
Security headers that matter, and the ones to retire
A practical guide to CSP with nonces, HSTS and preload, frame-ancestors, Referrer-Policy, Permissions-Policy and COOP, with examples and what to drop.
-
Before you connect company data to an AI assistant
A checklist for IT teams: data classification, hostile input, access control, logging, vendor review and ownership before connecting an LLM.
-
How to design and test secure file uploads
A checklist of controls for file upload features, based on the OWASP cheat sheet, with a table of tests to run against each upload endpoint.