OneTaskBy Tim King · Updated
Password Hash Identifier
Identify bcrypt, Argon2, NTLM and MD5 Hashes, With the Matching hashcat Mode
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Password Hash Identifier works
Paste a hash into this password hash identifier and it names the likely format, from modern bcrypt and Argon2 strings to Linux shadow entries, Django and Flask hashes, LDAP values and plain hex digests. Each match shows its hashcat mode number and a short note. The hash never leaves your browser.
How the password hash identifier decides
Modern password hashes are self-describing. They start with an identifier such as $2b$ for bcrypt,
$argon2id$ for Argon2 or $6$ for sha512crypt, followed by the cost settings, salt and digest. These
prefixes identify the format with certainty. Plain hex digests carry no label, so only their length can
be used: a 32-character hex string could be MD5, NTLM, MD4 or LM, and nothing in the string itself says
which.
Using the context
When a hex digest has several candidates, the source usually settles it. A Windows SAM dump or
secretsdump output is NTLM. A web database column from an old PHP application is probably MD5, maybe
with a salt in another column. A 40-character value from Git is SHA-1. The first row shown is the most
common format for that length.
Which formats are safe
bcrypt, scrypt, Argon2id and PBKDF2 with a high iteration count are designed for passwords. They are slow and salted. MD5, SHA-1, SHA-256 and NTLM on their own are fast hashes, and passwords stored that way can be cracked at billions of guesses per second, so treat them as a finding to fix.
FAQ
Can this tool crack or reverse a hash?
No. It only recognises the format. Hashes are one-way functions; recovering a password means guessing candidates and hashing each one. Knowing the format and hashcat mode is the first step for an authorised test, and a clear sign of how urgently storage needs upgrading.
Why is a 64-character hex value not definitely SHA-256?
SHA-256, SHA3-256, Keccak-256 and BLAKE2s all produce 32 bytes, written as 64 hex characters. The output looks equally random for each. SHA-256 is by far the most common, so it is listed first, but the system that produced the hash is the only reliable answer.
What is the hashcat mode number?
Hashcat, the password recovery tool, uses a number to select each algorithm, given with the -m option.
Mode 0 is MD5, 1000 is NTLM, 1800 is sha512crypt and 3200 is bcrypt. John the Ripper uses format names
instead, which usually match the type names listed here.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 digests from text.
Bcrypt Generator
Generate and verify bcrypt password hashes.
NTLM Hash Generator
Windows NTLM and LM hashes of a password, computed in your browser.
HMAC-SHA256 Generator
Sign a message with HMAC-SHA256 and verify signatures.
Bcrypt Cost Benchmark
Time bcrypt cost factors and pick one that fits your login budget.