Tools · Hashing and verification
Hash identifier
Paste a hash and see which algorithm or password format it looks like, going by its prefix, length and alphabet.
Nothing you paste here leaves your browser. This tool only describes a hash's shape. It does not crack, reverse or look up anything.
This hash identifier looks at a hash and tells you what it probably is, from its length, its characters and any prefix it carries. Paste an MD5, a SHA-256, a bcrypt string, an Argon2 string or a Linux password entry and it lists the candidates with its reasoning. It only describes the hash's shape, and it runs in your browser.
How it recognizes a hash
A hash has very few features, so identification is part certainty and part list of suspects. The certain part covers the formats that carry a label. A bcrypt hash starts with $2b$ and a cost, an Argon2 hash with $argon2id$ and its memory and time settings, and a Linux password entry with $6$ for SHA-512 crypt. Those prefixes are part of the format, so a match is close to proof. The tool reads the parameters inside them too. A bcrypt cost of 12 means 4,096 times as much work as cost 0, and an Argon2 string tells you how much memory the hash needs.
The uncertain part is a bare string of hex digits, where all you have is the length. A 64-character value is 256 bits, which is SHA-256 most of the time but could also be SHA3-256, BLAKE2s, BLAKE3, SHA-512/256 or Ethereum's Keccak-256. The tool lists them in a sensible order and says why, instead of pretending to know. If you know where the hash came from (a database dump, a download page, a Git repository), that context is better evidence than anything on the page.
Reading the length of a plain hash
| Hex characters | Bits | Usually |
|---|---|---|
| 8 | 32 | CRC-32 (a checksum, not a security hash) |
| 32 | 128 | MD5, or an NTLM hash if it came from Windows |
| 40 | 160 | SHA-1, or a Git object id |
| 56 | 224 | SHA-224 |
| 64 | 256 | SHA-256 |
| 96 | 384 | SHA-384 |
| 128 | 512 | SHA-512 |
Base64 digests are shorter for the same size, because each Base64 character carries six bits instead of four. A SHA-256 is 44 characters ending in = (or 43 without padding), a SHA-1 is 28, and a SHA-512 is 88. The tool recognizes those lengths too, and the OpenSSH SHA256:… fingerprint format.
Fast hashes and password hashes are different animals
The tool marks each result as a fast hash or a password hash, because that decides how worried to be if the hash leaks. A plain MD5, SHA-1 or SHA-256 takes microseconds to compute, so someone holding a list of them can test billions of guesses a second on one graphics card. A password hash such as bcrypt, scrypt, Argon2 or PBKDF2 is slow on purpose, and the good ones need a lot of memory too. The same weak password takes a fraction of a second to find in an MD5 list and may be out of reach in an Argon2 one. The password crack-time estimator puts numbers on that, using published benchmark rates.
cipher.ink uses PBKDF2 with HMAC-SHA256 at 600,000 iterations to turn a passphrase into a key, and the PBKDF2 article explains why. The fast hashes you may have met elsewhere in this section have their own tools. The hash generator computes them and the comparer checks two against each other.
What it won't tell you
- It won't reveal the password or input behind a hash, or look the hash up in a table of known values. Neither is possible from the hash alone, and a tool that claimed otherwise would be sending your hash somewhere.
- It can't tell a salted hash from an unsalted one when the salt is stored elsewhere. If your string looks like
hash:salt, it says so. - It can't tell MD5 from NTLM from MD4 by length. All three are 128 bits, so it gives you all three.
Common questions
Is it safe to paste a real password hash here?
Nothing is sent anywhere. The page makes no network requests, and its Content-Security-Policy forbids them. Still, a hash from a live system is sensitive, so paste only what you need and prefer working on a copy.
What does the cost number in a bcrypt hash mean?
It's a base-2 logarithm of the number of rounds. Cost 12 is 212 = 4,096 rounds of bcrypt's expensive key setup, and each increase of one doubles the time to compute it.
Why does it list several algorithms for one hash?
They share the same output length, and a digest carries no label of its own. The order goes by how common each algorithm is, which is a guess about probability and not proof.
My hash looks like hex but has the wrong length.
It may have been truncated when copied, or padded, or it may not be a hash at all (a key or an id). The tool gives you the bit length so you can see how far off it is.