Password Hash Identifier
Identify bcrypt, Argon2, scrypt, PBKDF2, Unix crypt, LDAP, and legacy hash formats
This tool identifies candidate formats from string structure only. It does not verify, crack, or audit the original password.
Candidate algorithms, confidence, and parsed parameters will appear here.
About this tool
Password Hash Identifier classifies one stored password hash by prefixes, separators, character sets, lengths, and embedded work parameters. High-confidence rules cover bcrypt, Argon2, scrypt, Django and Passlib PBKDF2, Werkzeug PBKDF2, Unix md5crypt/sha256crypt/sha512crypt, yescrypt, LDAP schemes, phpass, and MySQL 4.1. Unprefixed hexadecimal strings are reported only as low-confidence bit-length candidates because MD5, NTLM, SHA families, and application-specific digests can share the same shape. The tool identifies formats only; it does not verify passwords, crack hashes, judge parameter strength, or prove how a value was generated.
Scenario Recipes
Triage hashes during a password-store migration
Goal: Group legacy records before choosing a verification and rehash strategy
- Paste one representative stored value and record the top candidate and confidence.
- Repeat for each distinct prefix or shape, keeping low-confidence raw digests separate.
- Confirm formats in the source application's code or documentation before implementing verification and login-time rehashing.
Result: A preliminary format inventory that preserves uncertainty instead of treating guesses as proof.
Frequently Asked Questions
Can a hash format be identified with certainty?
Self-describing modular formats are high confidence; raw hex digests usually cannot be distinguished by appearance alone.
Does the tool crack or reverse hashes?
No. It only matches structural patterns and never attempts password recovery.
Which work parameters can it show?
Depending on the format it can extract bcrypt cost, Argon2 memory/time/parallelism, PBKDF2 rounds, or crypt rounds.
Why is a 32-character hex value low confidence?
It could be MD5, NTLM, another 128-bit digest, or an application-specific identifier without a format prefix.
Does recognition mean the hash is secure?
No. Security depends on algorithm, parameters, salt, implementation, password quality, and threat model.
Is the hash uploaded?
No. Pattern matching and parameter extraction run locally in the browser.
Keep browsing