Question 1

Can a hash identifier prove the exact algorithm?

Accepted Answer

Usually no. Format analysis can narrow candidates, but it cannot prove the exact algorithm when two algorithms share the same length and alphabet. A 64-character hexadecimal digest, for example, could be SHA-256, SHA3-256, BLAKE2s, or another 256-bit digest.

Question 2

Can hashes be decoded or decrypted?

Accepted Answer

No. A cryptographic hash function is designed as a one-way transformation. You can verify a guessed plaintext by hashing it and comparing the result, but you cannot decrypt the digest back to the original message.

Question 3

Why do bcrypt and Argon2 hashes look different from MD5 or SHA?

Accepted Answer

Password hashes usually store algorithm identifiers, parameters, salt, and digest together in one encoded string. That is why bcrypt starts with prefixes such as $2b$ and Argon2 strings include memory, iteration, and parallelism settings.

Question 4

Is an 8-character hexadecimal value a hash?

Accepted Answer

It may be a checksum such as CRC32 or Adler-32 rather than a cryptographic hash. Checksums are useful for accidental error detection, but they are not designed to resist malicious collisions.

Question 5

Why does the verifier only check exact text?

Accepted Answer

Hashes change completely when the input changes by even one character. Newlines, spaces, encoding, capitalization, and Unicode normalization all affect the digest.

Question 6

How many hex characters is MD5, SHA-1 and SHA-256?

Accepted Answer

MD5 is 32 hex characters, SHA-1 is 40 and SHA-256 is 64. One hex character carries 4 bits, so the character count is the digest size in bits divided by 4: 128, 160 and 256 bits. SHA-224 is 56, SHA-384 is 96 and SHA-512 is 128.

Question 7

Does uppercase or lowercase hex change the hash type?

Accepted Answer

No. A-F and a-f are the same digits, so the tool matches hex case-insensitively. It also strips surrounding whitespace and a leading 0x before checking. Only the MySQL 4.1+ pattern asks for uppercase hex after its asterisk.

Question 8

How can I tell MD5 from NTLM, or SHA-256 from SHA3-256?

Accepted Answer

You cannot from the string alone. Each pair shares one length and alphabet. Use where the value came from (an NTLM hash comes from a Windows or Active Directory store; it is MD4 of the UTF-16LE password) or hash a known plaintext with each candidate and compare. For abc, SHA-256 gives ba7816bf... and SHA3-256 gives 3a985da7..., so one known input separates them.

Question 9

What do the $ sections of a password hash mean?

Accepted Answer

Most modular crypt strings follow $id$parameters$salt$hash. In a bcrypt string, $2b$ is the scheme, the next two digits are the cost, then comes a 22-character salt and a 31-character hash, which makes 60 characters in total. The $6$ format holds a salt of up to 16 characters and an 86-character hash.

Question 10

Why do the digests of abc and the empty string appear so often?

Accepted Answer

They are the standard test inputs in the hash specifications (RFC 1321 for MD5, FIPS 180 for SHA-1 and SHA-2). Recognising d41d8cd98f00b204e9800998ecf8427e as the MD5 of empty input, or e3b0c442... as the SHA-256 of empty input, tells you an empty value or empty file was hashed.

Format	Typical Algorithm	Security Note
32 hex chars	MD5	Legacy checksum only; collision-broken.
40 hex chars	SHA-1 or RIPEMD-160	Ambiguous by length; SHA-1 is collision-broken.
64 hex chars	SHA-256 or SHA3-256	Common modern 256-bit digest shape.
$2b$...	bcrypt	Password hash with salt and work factor.
$argon2id$...	Argon2id	Memory-hard password hash format.

Hex characters	Bits	Candidate algorithms	Note
8	32	CRC32, Adler-32	Checksums for accidental errors, not cryptographic hashes.
32	128	MD5, MD4, NTLM, LM	MD5 is the usual guess; NTLM is MD4 of the UTF-16LE password.
40	160	SHA-1, RIPEMD-160	Git object IDs are SHA-1 by default.
56	224	SHA-224, SHA3-224, SHA-512/224	Rare in the wild; SHA-224 is the common reading.
64	256	SHA-256, SHA3-256, Keccak-256, BLAKE2s-256, SHA-512/256	The most ambiguous common length. SHA-256 is the usual guess.
96	384	SHA-384, SHA3-384	SHA-384 is a truncated SHA-512 variant.
128	512	SHA-512, SHA3-512, BLAKE2b-512, Whirlpool	Several unrelated 512-bit designs share this length.

Prefix	Scheme	Structure	Note
$2a$ $2b$ $2y$	bcrypt	$2b$ + 2-digit cost + $ + 22-char salt + 31-char hash (60 characters total)	The letter marks implementation revisions of the same scheme.
$argon2id$ $argon2i$ $argon2d$	Argon2	$argon2id$v=19$m=..,t=..,p=..$salt$hash (Base64 without padding)	Memory, time and parallelism costs travel inside the string.
$1$	md5crypt	$1$ + salt of up to 8 chars + $ + 22-char hash	Legacy Unix format; avoid for new systems.
$5$	SHA-256 crypt	$5$ + optional rounds=N$ + salt of up to 16 chars + $ + 43-char hash	glibc-style modular crypt format.
$6$	SHA-512 crypt	$6$ + optional rounds=N$ + salt of up to 16 chars + $ + 86-char hash	Long-time default in many Linux /etc/shadow files.
$y$	yescrypt	$y$ + parameter string + $ + salt + $ + hash	Newer /etc/shadow default on some distributions.
$P$ $H$	phpass	34 characters: prefix, iteration character, 8-char salt, 22-char hash	WordPress and Drupal style portable hashes.
pbkdf2_sha256$	Django PBKDF2	algorithm$iterations$salt$Base64 hash	passlib writes the same family as $pbkdf2-sha256$...
$scrypt$	scrypt (passlib)	$scrypt$ln=..,r=..,p=..$salt$hash	Cost parameters ln, r and p are stored in the string.
{SHA}	LDAP SHA-1	{SHA} + Base64 of the 20-byte SHA-1 digest (28 characters)	Unsalted; legacy.
*	MySQL 4.1+	* + 40 uppercase hex characters	SHA-1 of SHA-1 of the password.

Hash Identifier Tool

How Hash Identification Works

MD5 of the empty string

MD5 of "abc"

SHA-1 of "abc"

RIPEMD-160 of "abc"

SHA-224 of "abc"

SHA-256 of "abc"

SHA3-256 of "abc"

SHA-256 of the empty string

SHA-384 of "abc"

SHA-512 of "abc"

CRC32 of "abc"

Adler-32 of "abc"

History and Use Cases

Hash Identifier FAQ

Why Use This Hash Identifier?

Private

Fast

Actionable