PricingFree tierFAQ Sign in
Host your CTF freeTalk to the event team

Hash identifier and generator: what hash is this?

Paste a hash and see which algorithms it could be, ranked by how well its length, character set and prefix fit. Or type some text and get MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests instantly. Everything runs in your browser.

Open the tool
Nothing is uploaded MD5 to SHA-512 Copy in one click
Tool

Identify or generate a hash

Identification is a guess from shape alone: many algorithms produce output of the same length. Use it to narrow the field, then confirm from context.

Identify a hash

    Ranking is based on length, character set and known prefixes only. It cannot prove which algorithm made a hash.

    Generate hashes

      How hash identification works

      A hash function turns any input into a fixed-size digest, usually shown as hexadecimal. The digest size is set by the algorithm, so the length of a hash string is the strongest clue to what produced it. A 32-character hex string is 128 bits, a 40-character string is 160 bits, and so on. Password-storage formats such as bcrypt or sha512crypt add a readable prefix like $2b$ or $6$, which makes them easy to recognize.

      The limit is that several algorithms share a length. MD5 and NTLM are both 32 hex characters; SHA-1, RIPEMD-160 and MySQL 5 password hashes are all 40. This tool lists every common candidate and labels each one likely or possible. Treat the result as a short list, not a verdict.

      Hash length reference table

      Length / prefixBitsCommon algorithms
      8 hex32CRC32, Adler-32
      32 hex128MD5, NTLM, LM (half), MD4
      40 hex160SHA-1, RIPEMD-160, MySQL 5.x
      56 hex224SHA-224, SHA3-224
      64 hex256SHA-256, SHA3-256, BLAKE2s
      96 hex384SHA-384, SHA3-384
      128 hex512SHA-512, SHA3-512, Whirlpool, BLAKE2b
      $1$n/amd5crypt
      $5$ / $6$n/asha256crypt / sha512crypt
      $2a$ $2b$ $2y$n/abcrypt (60 characters)
      $argon2id$n/aArgon2 (argon2i, argon2d, argon2id)

      When you use this in CTFs

      Forensics and web challenges often hand you a hash in a database dump, a config file or a cookie. Knowing whether it is a fast digest (MD5, SHA-256) or a slow password hash (bcrypt, Argon2) tells you what the challenge expects. Generating digests is just as common: checking a downloaded file or a flag format such as flag{md5(...)} against a published checksum.

      Worked examples

      The MD5 of the empty string is d41d8cd98f00b204e9800998ecf8427e, and the MD5 of abc is 900150983cd24fb0d6963f7d28e17f72. The SHA-256 of abc begins ba7816bf8f01cfea. A value starting $2b$12$ is bcrypt with a cost factor of 12. If a string uses only A-Z a-z 0-9 + / and ends in =, it is probably Base64, so decode it first with the encoder and decoder.

      Tips

      • Check for stray newlines. echo abc | md5sum hashes abc\n, not abc; use echo -n.
      • Use the hex-bytes mode for binary data, such as a captured key or nonce.
      • Mixed-case hex is still hex; case does not change the value.
      • MD5 and SHA-1 are fine for checksums but are not safe for security purposes.

      When to use this, and when to use hashid, name-that-hash or hashcat

      This page identifies by length and prefix and computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of text or hex bytes, all in your browser. It is a quick first look. It does not crack anything. Command-line identifiers such as hashID and Name-That-Hash know many more formats and print the matching hashcat mode, and recent hashcat versions can guess the mode themselves with --identify. Once you have a candidate, the cracking happens in hashcat or John the Ripper, not here. Online lookup sites that check a hash against precomputed tables can save time on unsalted MD5 or SHA-1, but they keep what you submit, so don't paste hashes from a client engagement.

      Try the encoder and decoder for Base64 and hex, browse the other CTF tools, read the learning guides, look up terms in the glossary, or practice on our practice event, Ouroboros CTF.